Policy for the Protection of Personal Data

NEXGEN SOLUCIONES S.A.S. (hereinafter «NEXGEN») in compliance with the personal data protection regime, especially as indicated in the Statutory Law 1581 of 2012, regulated by Decree 1377 of 2013, and other rules that modify or complement or add, issues this Privacy Policy, which is mandatory in all activities involving, in whole or in part, the collection, storage, use, circulation, transmission and/or transfer of personal information in its capacity as Data Controller.

NEXGEN values individual privacy and we want to give our site visitors the opportunity to know what information we collect about them and how we treat it. This Privacy Policy (this «Policy»), will be in effect as of October 31, 2022, and explains:

PURPOSE

  1. To adopt and establish the rules applicable to the processing of personal data that is collected, processed and/or stored by NEXGEN in the pursuit of its corporate purpose, in its capacity as Data Controller or by third parties in their capacity as agents of NEXGEN.
  2. To communicate to the holder of the personal data, the information processing policies that will be applied to their personal data; and communicate the rights of the said holders and how to exercise them.

SCOPE OF APPLICATION

This Policy shall apply to the Processing of personal data for the processing of which NEXGEN shall be Data Controller, as well as to any personal data that are transmitted to third parties for processing as processors.

The principles and provisions contained in this Personal Data Policy shall apply to any Personal Data Base in the custody of NEXGEN in its capacity as Data Controller of personal data.

Personal data may be collected by NEXGEN, through its website, or social media accounts when the customer initiates communication by these means, through the execution of contracts of any nature with third party suppliers, customers, or employees, among others, and through surveys or participation in events organized by NEXGEN independently or in association with third parties. For the collection and processing of information, NEXGEN shall comply with the provisions of Law 1581 of 2012 and others that complement and / or modify it, and shall obtain prior, express and informed authorization from the Holders of personal data.

Likewise, NEXGEN may have access to personal data bases transferred by its suppliers or allies, which will be treated in the capacity of the Responsible Party, applying their privacy policy and only for the purposes defined in the contracts and/or data transfer clauses.

For the purposes of this Privacy Policy and in accordance with Law 1581 of 2012 and other applicable regulations, the following definitions are established:

  1. Authorization: Prior, express, and informed consent of the holder to carry out the processing of personal data.
  2. Database: Organized set of personal data that is subject to Processing.
  3. Personal data: Any information linked or that can be associated to one or several determined or determinable natural persons.
  4. Sensitive Data: Data that affects the intimacy of the holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life, and biometric data.
  5. Data Processor: Natural or legal person, public or private, who by itself or in association with others, performs the Processing of personal data on behalf of the Data Controller.
  6. Data Controller: Natural or legal person, public or private, who by himself or in association with others, decides on the database and/or the processing of the data.
  7. Data Holder: Natural person whose personal data is the object of Processing.
  8. Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.
  9. Purposes and Processing to which Personal Data will be submitted: The personal data that NEXGEN collects, stores, uses, circulates and deletes, and in general processes will be used for any of the following purposes:
  1. Relating to the operation of NEXGEN
    1. Human Resources: The Processing of Data will be carried out for the selection and/or recruitment process, performance evaluations or provision of services, administration of human resources, retirement or termination of employment contracts. The above depends on the type of legal relationship existing between the Holder of the information and NEXGEN (including, among others, applicants for positions, employees, former employees and trainees).
    2. Suppliers and Contractors of NEXGEN: The processing of data will be carried out for purposes related to the development of the contractual management process of products or services that NEXGEN requires for its operation in accordance with current regulations.
    3. Security at NEXGEN’s facilities: The Processing will be carried out for the surveillance and security of people, property and NEXGEN’s facilities.
  2. Purposes for the cases in which NEXGEN acts in its capacity as Processor.

In cases where NEXGEN acts in the capacity of a Processor, the processing of personal data to which it has access is limited exclusively to the purposes related to the execution of the contractual relationship and in any case on behalf of the responsible party, safeguarding at all times the security of the databases on which the assignment exists.

COLLECTED DATA

  1. Information collected automatically when you visit the website:

    By browsing the website and accessing or using the services offered, NEXGEN will collect and store cookies. For more information, please visit the Cookie Policy page.

  2. Information is collected when the user voluntarily identifies himself/herself and provides the requested information:

    You may choose to contact NEXGEN in writing or complete certain online forms or data requests, in which you provide personal information such as: name, phone number, email address, job title and related information.

PURPOSES OF DATA USAGE

NEXGEN will use the information collected as a function of and for:

  1. Answering inquiries;
  2. Evaluate requests or requirements;
  3. To send appropriate information regarding news, events, job offers and related information to which the user subscribes;
  4. For direct marketing purposes, including sending newsletters, customer alerts and information that NEXGEN believes may be of interest to the user;
  5. Market and consumer studies with respect to product types, demographics and consumer preferences.
  6. NEXGEN’s legitimate interest, such as conducting research and development, marketing and promoting services, protecting its own legal rights and interests;
  7. With the consent of the Data Holder to use his or her data for a specific purpose;
  8. To process the Data Holder’s data in order to comply with legal obligations;
  9. Selection and/or hiring processes, performance of functions or provision of services, human resources management, retirement or termination of employment contracts. The above depending on the type of legal relationship between the Data Subject and NEXGEN (including, among others, applicants or applicants for positions, employees, former employees and trainees);
  10. Development of the contractual management process of products or services that NEXGEN requires for its operation in accordance with current regulations;
  11. surveillance and security of NEXGEN’s people, property and facilities;
  12. In cases where NEXGEN acts in the capacity of a Processor, the processing of personal data to which it has access is limited exclusively to the purposes related to the execution of the contractual relationship and in any case on behalf of the responsible party, safeguarding at all times the security of the databases on which the assignment exists.

RETENTION OF PERSONAL DATA

NEXGEN will retain Data Holder data for as long as necessary to fulfill the purposes for which it was collected or as necessary to comply with legal obligations, resolve disputes and maintain appropriate business records.

Once the purpose for which the data was collected has been fulfilled, the data is stored in a secure manner, using all commercially reasonable efforts to maintain the protection of such data, in order to respond to legal, governmental, or judicial requirements of national and international entities and until its statute of limitations has expired.

DISCLOSURE OF PERSONAL DATA

NEXGEN may share collected data with its affiliates. In addition, NEXGEN reserves the right to provide information to comply with obligations under the law or those imposed by valid legal process (search warrant, subpoena or court order), as well as for the protection of NEXGEN’s rights or property, including, but not limited to, a transfer of control of NEXGEN or substantially all of its assets, or during emergencies when security is at risk.

STORAGE OF PERSONAL DATA

All information collected by NEXGEN by any means described in this Policy will be stored on secure servers so that the collected data is protected from unauthorized use and access. NEXGEN will also take all commercially reasonable measures to prevent unauthorized use and access of the collected data.

DATA HOLDERS’ RIGHTS

The owners of personal data processed by NEXGEN, may exercise the following rights before the company:

  1. know, delete, restrict, oppose, update, and rectify their personal data against NEXGEN as Data Controller and Data Processor. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data or data whose processing is expressly prohibited or has not been authorized;
  2. Request proof of the authorization granted to NEXGEN as Controller, except in the cases exempted by Article 10 of Law 1518 of 2012;
  3. To revoke the authorization and/or request the deletion of your personal data;
  4. To be informed by NEXGEN upon request, regarding the use that has been given to the personal data of the Data Subject;
  5. Refrain from providing or authorizing the processing of sensitive data, and voluntarily answer questions that relate to sensitive data or minors;
  6. To revoke the authorization and/or request the deletion of the personal data. The revocation and/or deletion will not proceed when the Data Holder has a legal or contractual duty to remain in the database;
  7. Access, free of charge, to the personal data that have been the object of the processing;
  8. File complaints with the Superintendence of Industry and Commerce for possible violations of the provisions of this Privacy Policy or Law 1581 of 2012 and other rules that modify, add or supplement it. To do so, the holder must have exhausted the complaint process before NEXGEN.

DATA OF MINORS

The provision of personal data of minors is optional and must be done with the express authorization of the parents or legal guardians of the minor.

SENSITIVE DATA

Sensitive personal data correspond to those that affect the privacy of the Data Holder or whose improper use may cause discrimination, such as those that reveal race or ethnicity, political orientation, religious or philosophical convictions, membership in trade unions, social organizations, human rights, or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sex life and biometric data, among others.

When there are exceptions under which the Processing of sensitive personal data is allowed, this must be done informing the Holder that he/she is not obliged to authorize the Processing of sensitive personal data, informing which are the sensitive data and the purpose of the processing, as well as obtaining the express consent of the person to whom the respective sensitive data belongs to.

HOLDER’S AUTHORIZATION

Notwithstanding the exceptions established by law, the Processing requires the prior, express and informed authorization of the Data Holder, which must be obtained by any means that may be subject to consultation and subsequent verification.

Authorization may also be obtained from unequivocal conduct of the Data Holder that allows it to reasonably conclude that he/she gave his/her consent for Processing.

CASES IN WHICH AUTHORIZATION IS NOT REQUIRED

The authorization of the Holder shall not be required in the following cases:

  1. Information required by a public or administrative entity in the exercise of its legal functions or by court order;
  2. Data of a public nature;
  3. Cases of medical or health emergency;
  4. Processing of information authorized by law for historical, statistical or scientific purposes;
  5. Data related to the Civil Registry of Individuals.

PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF THE PERSONAL DATA HOLDERS

The queries and claims raised by Personal Data Holders before NEXGEN, in accordance with their rights, shall be processed in accordance with the procedure set forth in Articles 14, 15 and 16 of Law 1581 of 2012.

  1. To initiate the processing of petitions, requests, queries or claims related to the Processing of Personal Data, the Data Holder or his/her assignees may use any of the following communication channels:
    1. At NEXGEN’s headquarters: Carrera 7 B No. 123 – 46 Bogotá D.C., from Monday to Friday from 9:00 AM to 4:00 PM).
    2. By telephone: (601) 384 17 22
    3. By email: administrativo@nexgen-soluciones.com

    Requests, inquiries or complaints received through the different channels will be directed to the area that NEXGEN has designated for the attention of requests, inquiries or complaints.

  2. Procedure to exercise Rights:
      1. Requests and Inquiries: They will be resolved within a maximum term of ten (10) business days from the date of receipt. When it is not possible to answer the consultation within such term, the Holder shall be informed before the expiration of the 10 days, stating the reasons for the delay and indicating the date on which the request will be answered, which in no case may exceed five (5) business days following the expiration of the first term.
      2. Complaints: Individuals who consider that the information contained in a NEXGEN database should be subject to correction, updating or deletion, or who notice the alleged breach of any of the duties contained in Law 1581 of 2012, may file a claim with NEXGEN, through any of the communication channels described herein; and it shall contain the following information:

        • Name and identification of the Holder.

        • The precise and complete description of the facts that give rise to the claim.

        • The physical or electronic address to send the response and report on the status of the process.

        • The documents and other evidence that are intended to be alleged

        If the claim submitted is incomplete, NEXGEN shall require the interested party within five (5) days of receipt thereof to remedy the deficiencies. After two (2) months from the date of the request, without the petitioner submitting the requested information, it will be understood that the request has been withdrawn.

        Once NEXGEN receives the completed claim, it will include in the respective database a legend that says «claim in process» and the reason for it, within a period not exceeding two (2) business days. Said legend will be maintained until the claim is decided.

        The maximum term to address the claim shall be fifteen (15) business days from the day following the date of receipt thereof, and if it is not possible to respond within such term, NEXGEN shall inform the interested party the reasons for the delay and the date on which the claim will be addressed, without exceeding, in any case, eight (8) business days following the expiration of the first term.

TRANSMISSION AND TRANSFER

In order to comply with the processing described above, NEXGEN may hire third-party services or enter into commercial or other agreements, in order to meet its business objectives and values.

In these cases, the information containing personal data will be transferred or transmitted with the subscription of privacy clauses to safeguard the privacy of the Data Holder and the proper provision of service, and compliance with other legal and constitutional duties.

NEXGEN may enter into agreements with natural or legal persons, domestic or foreign, for the transmission or transfer of personal data for commercial purposes. Once the personal data has been transferred, NEXGEN shall cease to be responsible for the processing and the transferred data shall be governed by the policies of the recipient of the information.

NEXGEN may enter into agreements or arrangements for the provision of external services, including the provision of cloud services, which may include agreements for the transmission of personal data, where the third party service provider will act as Data Processor.

ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS

In accordance with the California Consumer Privacy Act («CCPA»), we inform those users who are residents of the state in question, that data collected from you that you are a Data Holder or that may be associated with you as an individual, that this section shall apply in addition to NEXGEN’s Personal Data Protection Policy. This describes the data collection practices during the 12-month period prior to any request a consumer makes under the terms of this section of the Policy.

  1. Statements required by CCPA.

    1. Categories of Personal Information Collected («Personal Information»): NEXGEN may collect Personal Information including, but not limited to, (a) Identifying information, such as name, address, email address, telephone number, (b) internet or other electronic network activity, including, but not limited to, search history, interactions, application or advertising, as well as (c) employment information, including CVs and information related to current or past employment, (d) academic information, such as grades, years of study and academic institutions in which the Holder was enrolled.

  2. Sale of Personal Information:

    NEXGEN will not conduct sales of personal information.

  3. Rights of Consumers that are California Residents:

    1. No Sale of Information: NEXGEN does not sell personal information, so the right to opt-out of the sale of personal information does not apply to the information collected.

    2. To Know and access specific information: The Personal Information Holder has the right to request information regarding the categories of personal information that NEXGEN collects about the Holder during the twelve (12) months prior to the query, and for each category, may request the business purposes for which the information was collected, the categories of sources of that personal information, and the categories of entities with which the information was shared, if any. You also have the right to access specific portions of the personal information collected. This right may be exercised two (2) times within a twelve (12) month period.

    3. Request deletion of personal information: The Personal Information Holder has the right to request that certain information be deleted. The exercise of this right is subject to the following restrictions such as: (a) preservation for legitimate legal and/or commercial purposes, (b) dispute resolution, (c) answering legal, judicial or administrative claims, (d) performing audits and/or executing contracts.

  4. How to exercise these rights: The exercise of the rights set forth in this section is made by means of a verifiable request, i.e., one that is made indicating the right to be exercised and that permits and allows validating that the applicant is the Holder of the personal information or is a person duly authorized by the Holder. It must contain sufficient elements to verify the identity of the person making the request.

    To exercise the rights enshrined herein, the Holder or authorized person may contact the telephone number (601) 384 17 22 or use the e-mail administrativo@nexgen-soluciones.com. The personnel in charge will respond to the Holder or the person duly authorized by the Holder within ten (10) days of receipt of the request in order to confirm receipt of the request and inform the next steps that are required in order to proceed with the request. In the event that the request is verified, the requested information will be sent or the actions required by the Holder of the information or person duly authorized by the Holder will be executed within forty-five (45) calendar days from the time of receipt.

    When it is not possible to perform the requested actions within the term established herein, NEXGEN will inform the Holder or person duly authorized by the Holder, about the status of the request and the additional time required to comply with it.

    NEXGEN is authorized to reject requests made by the Holders of personal information or persons duly authorized by them. NEXGEN may reject requests in the following cases: (a) when it is not possible to verify that the user or the person making the request is duly authorized to do so, (b) when the request is manifestly unfounded or excessive, especially when it is repetitive in nature, or (c) when complying with the request implies the violation of other obligations stipulated by the laws of California. If the request is denied, NEXGEN will notify the applicant of the denial of the request. In such notice NEXGEN will explain in detail why the application is rejected, the aforementioned notification shall be sent by e-mail to the address with which the request was filed.

    The exercise of the rights enshrined in this section shall not generate any cost for the Holder of the personal information, however, in cases where the request is manifestly unfounded or excessive NEXGEN shall be entitled to impose a reasonable administrative fee, based on the cost involved in resolving the request.

  5. Non-discrimination for the exercise of rights: NEXGEN shall not discriminate against the Data Holder who by himself or through a duly authorized person exercises any right contemplated in the CCPA.

  6. Other Privacy Rights: The «shine the light» law allows users of NEXGEN’s website who are California residents to request certain information about the sharing of their personal information with third parties for direct marketing purposes. NEXGEN will not share personal information collected with third parties for their direct marketing purposes.

  7. Children’s Privacy: NEXGEN’s website is not intended for or directed to children under the age of thirteen (13), therefore, NEXGEN does not collect or solicit personal information from children under the age of thirteen (13). If NEXGEN is informed that it has collected personal information from a child under the age of thirteen (13), it will delete such personal information in accordance with applicable law.

DATA PROTECTION AUTHORITY

In cases where the Data Holder considers that there has been an unjustified delay in the procedure described above, or that their requests, queries or claims have not been processed in a satisfactory manner, they may address any questions or complaints about the use and/or processing of their data to the Superintendence of Industry and Commerce.

CONTACT

In the event that the Data Holder, or any competent authority has any concerns regarding the information described herein, he/she may contact NEXGEN by e-mail at administrativo@nexgen-soluciones.com or by using the following information:

NEXGEN SOLUCIONES S. A. S.
Carrera 7B No. 123 – 46
Bogotá, Colombia

OR

NXG PARTNERS LLC
1800 S. Ocean Drive.
Hallandale Beach FL. 33009, USA

UPDATES

NEXGEN will notify any updates to the Privacy Policy through the website https://nexgensoluciones.com/ or to the e-mail address registered in the databases. In cases where prior consent is required, it will be requested through the e-mail address registered in the databases.