1. INTRODUCTION
In accordance with the provisions of Article 15 of the Colombian Political Constitution, as well as Law 1581 of 2012, which established general provisions for the protection of personal data, and aware of the need to guarantee an adequate environment for the right of individuals to know, update and rectify the information collected about them in databases and files, BMI Colombia, as the Data Controller of the personal data used in the development of its corporate purpose, adopts the following Internal Manual of Policies and Procedures to guarantee adequate compliance with the Law and, in particular, for the handling of queries and complaints.
2. GENERAL OBJECTIVE AND SPECIFIC OBJECTIVES
2.1. GENERAL OBJECTIVE
Through this Manual, BMI Colombia informs you about the existence of the Information Processing Policies and the processing purposes adopted by the Company.
2.2. SPECIFIC OBJECTIVES
- Inform Data Subjects of the principles to which BMI Colombia applies the processing of personal data.
- Inform Data Subjects of their data protection rights.
- Establecer y comunicar el procedimiento establecido para que los Titulares puedan consultar su información o soliciten corrección, actualización o supresión de la misma.
3. SCOPE
The provisions of this Manual shall apply to the personal data of our consumers (clients, potential clients, users), intermediaries, employees, and suppliers.
All BMI Colombia employees are covered by this policy. Likewise, our business partners, suppliers, and contractors who, in the course of their work, have access to personal data of data subjects, whether they have provided it to BMI Colombia or received it from them, are required to comply with the law and this Policy.
4. LEGAL FRAMEWORK
- Article 15 of the Political Constitution of Colombia.
- Law 1581 of 2012.
- Decree 1377 of 2013.
- Decree 886 of 2014.
- The others that develop and/or modify them.
5. DEFINITIONS
- TOortorganization: Consentimiento previo, expreso e informado del Titular para llevar a cabo el Tratamiento de datos personales;
- BDatabase: Organized set of personal data that is the subject of
- Treatment;
- Dpersonal data: Any information linked to or that can be associated with one or more specific or determinable natural persons.
- Dsensitive data: Aquellos que afectan la intimidad del Titular o cuyo uso indebido puede generar su discriminación, tales como aquellos que revelen el origen racial o étnico, la orientación política, las convicciones religiosas o filosóficas, la pertenencia a sindicatos, organizaciones sociales, de derechos humanos o que promueva intereses de cualquier partido político o que garanticen los derechos y garantías de partidos políticos de oposición así como los datos relativos a la salud, a la vida sexual y los datos biométricos.
- ANDData Controller: Natural or legal person, public or private, who, by itself or in association with others, carries out the processing of personal data on behalf of the Data Controller;
- RData Controller: Natural or legal person, public or private, who by itself or in association with others, decides on the database and/or the processing of the data;
- TItemular: Natural person whose personal data are subject to processing;
- Ttreatment: Cualquier operación o conjunto de operaciones sobre datos personales, tales como la recolección, almacenamiento, uso, circulación o supresión.
6. PRINCIPLES
- Pprinciple of freedom: Data processing by BMI Colombia may only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial order that waives consent.
- Pprinciple of truthfulness or quality: The information subject to processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited;
- Pprinciple of transparency: In the Processing process, the right of the Data Subject to obtain from the Data Controller or the Data Processor, at any time and without restrictions, information about the existence of data concerning him/her must be guaranteed;
- PPrinciple of access and restricted circulation: This may only be done by persons authorized by the Data Subject. Personal data, except for public information or information mandated by law, may not be made available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Data Subjects or authorized third parties in accordance with this law.
- Principio de seguridad: La información sujeta a Tratamiento por el Responsable del Tratamiento o Encargado del Tratamiento a que se refiere la presente ley, se deberá manejar con las medidas técnicas, humanas y administrativas que sean necesarias para otorgar seguridad a los registros evitando su adulteración, pérdida, consulta, uso o acceso no autorizado o fraudulento;
- Principio de confidencialidad: Todas las personas que intervengan en el Tratamiento de datos personales que no tengan la naturaleza de públicos están obligadas a garantizar la reserva de la información, inclusive después de finalizada su relación con alguna de las labores que comprende el Tratamiento, pudiendo sólo realizar suministro o comunicación de datos personales cuando ello corresponda al desarrollo de las actividades autorizadas en la presente ley y en los términos de la misma.
7. RIGHTS OF THE OWNER
- Dirigirse a BMI Colombia, a través de los canales establecidos para tal fin, para conocer, actualizar y rectificar sus datos personales. Este derecho se podrá ejercer, entre otros frente a datos parciales, inexactos, incompletos, fraccionados, que induzcan a error, o aquellos cuyo Tratamiento esté expresamente prohibido o no haya sido autorizado;
- Solicitar a BMI Colombia, a través de los canales establecidos para tal fin, prueba de la autorización otorgada al Responsable del Tratamiento salvo cuando expresamente se exceptúe como requisito para el Tratamiento, de conformidad con lo previsto en el artículo 10 de la Ley 1581 de 2012.
- Be informed by BMI Colombia, upon request, regarding the use of your personal data.
- Presentar ante la Superintendencia de Industria y Comercio quejas por infracciones a lo dispuesto en las normas que regulan el derecho fundamental al Habeas Data.
- Revocar la autorización y/o solicitar la supresión del dato cuando en el Tratamiento no se respeten los principios, derechos y garantías constitucionales y legales. La revocatoria y/o supresión procederá cuando la Superintendencia de Industria y Comercio haya determinado que en el Tratamiento el Responsable o Encargado han incurrido en conductas contrarias a esta ley y a la Constitución. Acceder en forma gratuita a sus datos personales que hayan sido objeto de Tratamiento.
8. AUTHORIZATION
Without prejudice to the exceptions provided for in the Law, processing requires the prior and informed authorization of the data subject, which must be obtained by any means that can be subsequently consulted.
Such authorization is not necessary when it concerns:
- Information required by a public or administrative entity in the exercise of its legal functions or by court order.
- Data of a public nature.
- Cases of medical or health emergencies.
- Tratamiento de información autorizado por la Ley para fines históricos, estadísticos o científicos.
- Data related to the person's civil registry.
9. PURPOSE
9.1. General Purpose.
Among the general purposes for processing personal data, BMI Colombia will have the following, which will apply to financial consumers, intermediaries, suppliers, contractual counterparties, and employees:
- The process of requesting affiliation as a financial consumer, contractual counterparty, employee, and/or supplier.
- El proceso de negociación de contratos con BMI Colombia, incluyendo la determinación de primas y la selección de riesgos.
- Fraud control and prevention.
- Control compliance with the requirements for accessing the General Comprehensive Social Security System
- La elaboración de estudios técnico-actuariales, estadísticas, encuestas, análisis de tendencias del mercado y, en general, estudios de técnica aseguradora.
- Conducting surveys on satisfaction with the services provided by BMI Colombia and/or the insurance intermediary.
- Sending financial information of taxpayers in the United States to the Internal Revenue Service (IRS), under the terms of the Foreign Account Tax Compliance Act (FATCA),
- Intercambio de información tributaria en virtud de tratados y acuerdos internacionales suscritos por Colombia.
- The prevention and control of money laundering and terrorist financing.
- In general, the comprehensive management of contracts entered into with BMI Colombia, whether these are insurance contracts, intermediation contracts, supplier contracts, employment contracts, or commercial agreements or alliances.
9.2. Purpose of Financial Consumer data.
Their purpose is to use this information to properly provide the service or product purchased by the data subject. BMI Colombia may also inform the data subject about its products and services, and announce improvements or changes to its customer service channels and the complementary services and products offered.
It will also be used to send you information about the offers it has developed with business partners.
Likewise, its purpose will be to settle and pay claims and everything related to the comprehensive management of the insurance contract, as well as to send information related to financial education, customer satisfaction surveys, and commercial insurance offers, as well as other services inherent to the insurance business.
9.3. Purpose of data from suppliers, intermediaries and contractual counterparties.
The purpose of processing this data is to obtain up-to-date, reliable, and sufficient information about individuals who are, or would like to be, suppliers, intermediaries, and contractual counterparties. It also serves to verify the various eligibility requirements for a contractual relationship with BMI Colombia.
9.4. Purpose of employee data.
The processing of employee data seeks to keep employees' information up-to-date so that the employment relationship can be carried out appropriately. Your contact information may be shared with legal entities that are subsidiaries, affiliates, or related entities, or with the parent company of BMI Colombia, so that our employees have access to the benefits of purchasing products and services from the organization's companies.
Likewise, the data of former employees will be retained for the purpose of making them available to the authorities and the data subjects themselves for the period established by labor law.
9.5. Processing of sensitive data.
BMI Colombia will not collect, incorporate or store sensitive data from its financial consumers, employees or third parties unless there is a
Prior authorization from the data subject. The aforementioned authorization will only be requested when necessary and proportional to the execution of the contractual relationship with the data subject, provided that the law requires or permits access to the data subject's sensitive information. Authorization for the processing of sensitive data will be requested prior to its incorporation. The authorization will specify the purpose for which the data is being incorporated, indicate that responding to questions about sensitive data is optional, and include the other elements described in this policy for obtaining authorization for the processing of information. Sensitive data may not be processed for purposes other than those authorized by the data subject. Access, circulation, and processing of sensitive data will be restricted and limited to what is expressly authorized by the data subject and as stipulated by law.
10. PROCEDURES
10.1. Queries.
Data Subjects or their successors in title may consult the Data Subject's personal information held by BMI Colombia. Accordingly, BMI Colombia must provide them with all information contained in the individual record or linked to the Data Subject's identification.
The query will be made via email to the address contactenos@BMICOS.com.
The query will be answered within a maximum of ten (10) business days from the date of receipt. When it is not possible to answer the query within this period, the interested party will be informed, stating the reasons for the delay and indicating the date on which their query will be answered, which in no case may exceed five (5) business days following the expiration of the first term.
10.2. Claims.
The Owner or their successors in title who consider that the information contained in a database should be corrected, updated or deleted, or when they notice the alleged non-compliance with any of the obligations of the rules that regulate the fundamental right of Habeas Data or this Manual, may file a claim with BMI Colombia, which will be processed under the following rules:
1. The claim will be made by means of a request addressed to the email address contactenos@BMICOS.com, with the identification of the Holder, the description of the facts that give rise to the claim, the address, and accompanying the documents that are to be asserted. If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. After two (2) months from the date of the request, if the applicant does not present the required information, it will be understood that he has withdrawn the claim.
In the event that the person receiving the claim is not competent to resolve it, he/she will forward it to the appropriate person within a maximum period of two (2) business days and inform the interested party of the situation.
2. Una vez recibido el reclamo completo, se incluirá en la base de datos una leyenda que diga «reclamo en trámite» y el motivo del mismo, en un término no mayor a dos (2) días hábiles. Dicha leyenda deberá mantenerse hasta que el reclamo sea decidido.
3. The maximum term for addressing the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within this term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.
11. INTERNATIONAL TRANSMISSION OF PERSONAL DATA.
In order to provide a better service, and to execute the purposes described in this Policy, the personal data of the Holders may be transmitted to servers hosted in foreign countries, under security conditions that will guarantee compliance with the provisions of Law 1581 of 2012, Regulatory Decree 1377 of
2013.
12. PROVISION OF PERSONAL INFORMATION TO SERVICE PROVIDERS.
In order to comply with the contractual relationship that BMI Colombia maintains with the Data Subject, the information may be delivered or shared with suppliers for the purposes authorized by the subject or those provided for by law, such as claims adjusters, researchers, healthcare institutions and/or professionals, call centers, distributors and prevention professionals, insurance intermediaries, natural or legal persons who provide their professional services to perform statistics, actuarial calculations, software development and any other activity to carry out the corporate purpose of BMI Colombia and correctly provide the service.
Whenever information is provided or shared with suppliers, BMI Colombia will ensure that conditions are established that bind the supplier to this Policy, ensuring that customers' personal information is protected.
Likewise, confidentiality agreements will be established for the handling of information and obligations between the person responsible and the person in charge when the type of delivery warrants it.
13. DUTIES OF THE DATA CONTROLLER.
BMI Colombia, as Data Controller, must comply with the following obligations, without prejudice to other provisions established by law and other provisions governing its activity:
Guarantee the Holder, at all times, the full and effective exercise of the right to habeas data.
- Request and retain, under the conditions provided by law and this Manual, a copy of the respective authorization granted by the Owner.
- Properly inform the Owner about the purpose of the collection and the rights to which he or she is entitled by virtue of the authorization granted.
- Conservar la información bajo las condiciones de seguridad necesarias para impedir su adulteración, pérdida, consulta, uso o acceso no autorizado o fraudulento.
- Ensure that the information provided to the Data Processor is truthful, complete, accurate, up-to-date, verifiable and understandable.
- Actualizar la información, comunicando de forma oportuna al Encargado del Tratamiento, todas las novedades respecto de los datos que previamente le haya suministrado y adoptar las demás medidas necesarias para que la información suministrada a este se mantenga actualizada.
- Rectificar la información cuando sea incorrecta y comunicar lo pertinente al Encargado del Tratamiento.
- Suministrar al Encargado del Tratamiento, según el caso, únicamente datos cuyo Tratamiento esté previamente autorizado de conformidad con lo previsto en la presente ley.
- Demand that the Data Processor respect the security and privacy conditions of the Data Subject's information at all times.
- Process queries and complaints submitted in accordance with the terms set forth in this law.
- Adoptar un manual interno de políticas y procedimientos para garantizar el adecuado cumplimiento de la presente ley y en especial, para la atención de consultas y reclamos.
- Informar al Encargado del Tratamiento cuando determinada información se encuentra en discusión por parte del Titular, una vez se haya presentado la reclamación y no haya finalizado el trámite respectivo.
- Inform the Owner, upon request, about the use given to their data.
- Inform the data protection authority when security code violations occur and when there are risks in the management of Data Subjects' information.
- Cumplir las instrucciones y requerimientos que imparta la Superintendencia de Industria y Comercio.
14. DATA OF THE CONTROLLER
Company Name: BMI Colombia Life Insurance Company SANIT 901061386-7
Address: Carrera 11 No. 84-09, South Side | Office 903, Bogotá, Colombia
Email: premiersupportco@bmicos.com
15. VALIDITY AND MODIFICATIONS
BMI Colombia reserves the right to modify this Policy at any time, a circumstance that will be promptly reported on the Company's website.
