Free Demo
Qlip ERP

PERSONAL DATA PROCESSING POLICY

SCOPE

In compliance with the provisions of Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, MENTUM GROUP adopts this policy for the processing of personal data regarding the collection, storage, use, circulation, deletion, and all activities that constitute the processing of personal data. This policy will be communicated to all data subjects whose data has been collected or may be collected in the future as a result of the execution of its corporate purpose related to commercial or labor activities.

MENTUM GROUP, formed by the alliance between BIT CONSULTING S.A. (Tax ID: 830005677), 2 IN SOLUTIONS (Tax ID: 830139842), COMERCIALIZADORA DE SOFTWARE Y SOLUCIONES SAS (Tax ID: 900566693), and NOOVA (Tax ID: 901108864), domiciled in Bogotá at Cl. 98 Bis #71D-20, states that it guarantees the rights to privacy, intimacy, good name, and autonomy in the processing of personal data. Consequently, all its actions will be governed by the principles of legality, purpose, freedom, accuracy, quality, transparency, restricted access and circulation, security, and confidentiality.

All persons who, in the course of different commercial, contractual, labor, or other activities—whether permanent or occasional—provide any type of personal information to MENTUM GROUP may know, update, rectify, delete, or revoke previously granted authorization.

MENTUM GROUP is also authorized to consult, based on the personal data provided, lists of individuals and entities associated with terrorist organizations binding for Colombia, in order to comply with Law 1474 of 2011 and the Inter-American Convention Against Corruption.

DEFINITIONS

For the purposes of this policy and in accordance with Colombian legal regulations, the following definitions apply:

Authorization: Prior, express, and informed consent of the data subject to process personal data.

Privacy Notice: Physical, electronic, or any other format document made available to the data subject, informing them about the existence of data processing policies, how to access them, and the purpose of the processing.

Database: Organized set of personal data subject to processing.

Personal Data: Any information linked or linkable to an identified or identifiable natural person.

Public Data: Data classified as public by law, such as marital status, profession, or public records.

Private Data: Data of a private or intimate nature relevant only to the data subject.

Sensitive Data: Data that affect privacy or may lead to discrimination (e.g., racial origin, political views, religion, health, sexual life, biometric data).

Data Processor: Person or entity that processes data on behalf of the controller.

Data Controller: Person or entity that decides on the database and/or processing.

Data Subject: Natural person whose data is processed.

Processing: Any operation performed on personal data (collection, storage, use, circulation, deletion).

PURPOSE AND PROCESSING OF PERSONAL DATA

MENTUM GROUP collects and processes personal data for the following purposes:

  • Execute contractual relationships with clients, suppliers, and employees, including payments.
  • Provide requested services and/or products.
  • Inform about new or updated products or services.
  • Evaluate service quality.
  • Conduct internal consumer behavior studies.
  • Send commercial or promotional information via physical or electronic means (SMS, email, etc.).
  • Carry out marketing campaigns, promotions, or contests.
  • Manage recruitment and employment processes.
  • Support internal or external audits.
  • Maintain employee and pensioner records.
  • Comply with purposes authorized by the data subject.
  • Share data with affiliated or related companies locally or internationally.
  • MENTUM GROUP may also consult restrictive databases (e.g., sanctions lists, politically exposed persons lists) to comply with SARLAFT policies, preventing illicit activities while ensuring data protection.

MENTUM GROUP’S OBLIGATIONS

All parties required to comply with this policy must bear in mind that MENTUM GROUP is obligated to fulfill the duties imposed by law in this regard. Consequently, the following obligations must be met:

OBLIGATIONS WHEN ACTING AS THE DATA CONTROLLER

  1. Request and retain, under the conditions set forth in this policy, a copy of the respective authorization granted by the data subject.
  2. Inform the data subject clearly and sufficiently regarding the purpose of the collection and the rights to which they are entitled by virtue of the authorization granted.
  3. Inform the data subject, upon request, regarding the use made of their personal data.
  4. Process inquiries and complaints in accordance with the terms set forth in this policy.
  5. Ensure compliance with the principles of accuracy, quality, security, and confidentiality as established in this policy.
  6. Store information under the necessary security conditions to prevent its alteration, loss, unauthorized or fraudulent access, use, or disclosure.
  7. Update information as necessary.
  8. Correct personal data when appropriate.
  9. Report any irregularities to regulatory agencies such as the Attorney General’s Office and/or Interpol when a match is found in lists of individuals associated with terrorist organizations recognized by Colombia.
  10. Apply MENTUM GROUP’s internal work regulations and protocols to ensure due process in the event that paragraph (9) of the DUTIES WHEN ACTING AS DATA CONTROLLER must be applied.

OBLIGATIONS WHEN ACTING AS A PERSONAL DATA PROCESSOR

If you process data on behalf of another entity or organization (the data controller), you must comply with the following obligations:

  1. Ensure that the data controller is authorized to provide the personal data that will be processed by the data processor.
  2. Guarantee the data subject, at all times, the full and effective exercise of the right to access personal data.
  3. Store the information under the necessary security conditions to prevent its alteration, loss, unauthorized or fraudulent consultation, use, or access.
  4. Timely update, rectify, or delete the data.
  5. Update the information reported by data controllers within five (5) business days of receipt.
  6. Process inquiries and complaints submitted by data subjects in accordance with the terms set forth in this policy.
  7. Record the notation “complaint pending” in the database as established in this policy.
  8. Enter the notation “information under judicial review” into the database once notified by the competent authority of any legal proceedings related to the quality of personal data.
  9. Refrain from disseminating information that is being contested by the data subject and whose blocking has been ordered by the Superintendency of Industry and Commerce.
  10. Allow access to the information only to persons authorized by the data subject or empowered by law for that purpose.
  11. Notify the Superintendency of Industry and Commerce when security breaches occur and there are risks in the management of data subjects’ information.
  12. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.
  13. Request authorization for the processing of personal data from Mentum Group’s subsidiaries, affiliates, or subordinate companies when business operations require the processing of their personal data.
  14. Annually consult the lists of individuals and entities associated with terrorist organizations, as required by Colombia, and notify the data controller of any irregularities that may be found.

OBLIGATIONS WHEN PROCESSING IS CARRIED OUT BY A DATA PROCESSOR

  1. Provide the data processor only with personal data whose processing has been previously authorized. For the purposes of domestic or international data transfers, a personal data transfer agreement must be signed or contractual clauses must be agreed upon in accordance with the provisions of Article 25 of Decree 1377 of 2013.
  2. Ensure that the information provided to the data processor is truthful, complete, accurate, up-to-date, verifiable, and understandable.
  3. Promptly notify the Data Processor of any changes regarding the data previously provided to them and take all other necessary measures to ensure that the information provided to them remains up-to-date.
  4. Promptly inform the Data Processor of any corrections made to personal data so that they may proceed to make the necessary adjustments.
  5. Require the Data Processor, at all times, to comply with the security and privacy requirements regarding the data subject’s information.
  6. Notify the Data Processor when certain information is being disputed by the data subject, once a complaint has been filed and the relevant proceedings have not yet been concluded.
  7. Request that the Data Processor regularly (once a year) update the personal data of talent, suppliers, contractors, clients, and generally any person or entity that has a business relationship with MENTUM GROUP.

OBLIGATIONS TOWARD THE SUPERINTENDENCY OF INDUSTRY AND COMMERCE

  1. Report any violations of security codes and the existence of risks in the management of data subjects’ information.
  2. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

REQUEST FOR CONSENT FROM THE DATA SUBJECT

Prior to and/or at the time of collecting personal data, MENTUM GROUP will request the data subject’s consent to collect and process such data, specifying the purpose for which the data is being requested. Consent may be requested through automated technical means (such as online forms), in writing (such as physical forms), or orally (such as recordings of telephone calls). Proof of consent will be retained through electronic records, physical copies of signed forms, or audio recordings, as applicable.

Personal data collected directly at security checkpoints—including information provided by individuals to security personnel and obtained from video recordings made inside or outside MENTUM GROUP’s facilities—will be used for the security of individuals, property, and MENTUM GROUP’s facilities, and may be used as evidence in any legal proceedings. If personal data is provided, such information will be used solely for the purposes outlined herein; therefore, MENTUM GROUP will not sell, license, transmit, or disclose such information unless expressly authorized to do so; unless it is necessary to enable contractors to perform the services entrusted to them; unless it is necessary to provide our services and/or products;  it is necessary to disclose it to entities providing marketing services on behalf of MENTUM GROUP or to other entities with which joint marketing agreements exist; the information relates to a merger, consolidation, acquisition, divestiture, or other corporate restructuring process; or it is required or permitted by law.

MENTUM GROUP may subcontract certain functions or information to third parties. When the processing of personal information is outsourced to third parties or personal information is provided to third-party service providers, MENTUM GROUP instructs such third parties on the need to protect such personal information with appropriate security measures, prohibits the use of the information for their own purposes, and requires that they not disclose the personal information to others.

INFORMATION SECURITY

MENTUM GROUP is committed to the security and proper handling of personal data contained in its information assets, preventing unauthorized access by third parties who might view, modify, disclose, and/or destroy the information stored therein. To this end, the company has implemented a set of security controls designed to protect the technological infrastructure in which information is stored, processed, and transmitted.  Access to the various databases is restricted even for employees and contractors, with access granted only to those who strictly require it to perform their duties and activities. Likewise, all employees, contractors, and suppliers are committed to maintaining the confidentiality of the information, in accordance with the guidelines on information processing established by law.

SECURITY MEASURES

In accordance with the security principle established in Law 1581 of 2012, MENTUM GROUP will adopt the technical, human, and administrative measures necessary to ensure the security of records, preventing their alteration, loss, unauthorized or fraudulent consultation, use, or access. Personnel involved in the processing of personal data will follow established protocols to ensure information security.

TIME LIMITS ON THE PROCESSING OF PERSONAL DATA

MENTUM GROUP may only collect, store, use, or disclose personal data for as long as is reasonable and necessary, in accordance with the purposes that justified the processing, taking into account the applicable provisions regarding the matter in question and the administrative, accounting, tax, legal, and historical aspects of the information. Once the purpose(s) of the processing have been fulfilled and without prejudice to legal provisions to the contrary, it shall proceed to delete the personal data in its possession. Notwithstanding the foregoing, personal data must be retained when required to comply with a legal or contractual obligation.

PROCEDURE FOR INQUIRIES AND COMPLAINTS

Any request, complaint, or claim must include the data subject’s identification, a description of the facts giving rise to the claim, the address, and any supporting documents to be submitted.

INQUIRIES: The data subject or their successors may access the personal information stored in MENTUM GROUP’s databases upon request, which will be addressed within a maximum of ten (10) business days from the date of receipt. In the event that it is not possible to process the request within that timeframe, the data subject will be informed within the same timeframe, stating the reasons for the delay, as well as the date by which a response will be provided, which may not exceed five (5) business days following the expiration of the initial deadline.

COMPLAINTS: The Data Subject or their successors who believe that the information contained in a database should be corrected, updated, or deleted, or who become aware of an alleged breach of any of the obligations set forth in this law, may file a complaint with MENTUM GROUP, which will be processed in accordance with the following rules:

  1. The complaint must be filed by submitting a written request to MENTUM GROUP, including the data subject’s identification, a description of the facts giving rise to the complaint, and the data subject’s address, along with any supporting documents. If the complaint is incomplete, the data subject will be asked to correct the deficiencies within five (5) days of receipt of the complaint. If two (2) months have elapsed since the date of the request and the claimant has not submitted the required information, it will be understood that they have withdrawn the claim. If the person receiving the claim is not authorized to resolve it, they will forward it to the appropriate party within a maximum of two (2) business days and inform the claimant of the situation.
  2. Once the complete complaint is received, a note stating “complaint pending” and the reason for it will be added to the database (support help desk) within no more than two (2) business days. This note must remain until the complaint is resolved.
  3. The maximum timeframe for addressing the complaint shall be fifteen (15) business days, counted from the day following the date of receipt. If it is not possible to address the complaint within this timeframe, the complainant will be informed of the reasons for the delay and the date by which the complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial timeframe.
  4. The data subject or their representative may request that MENTUM GROUP correct, update, or delete their personal data, provided they first verify their identity. If the request is made by someone other than the data subject and it is not verified that the person is acting on the data subject’s behalf, the request will be deemed not to have been submitted. The request for correction, updating, or deletion must be submitted through the channels provided by MENTUM GROUP and must include at least the following:
    • Name and address of the data subject or any other means for receiving a response.
    • Documents proving the identity or legal standing of their representative.
    • A clear and precise description of the personal data giving rise to the request.

PARAGRAPH 1. CORRECTION AND UPDATE: When requests concern the correction or update of personal data, the data subject must specify the corrections to be made and provide supporting documentation for their request.

PARAGRAPH 2. DELETION: The deletion of personal data is carried out through the total or partial removal of personal information as requested by the data subject; however, MENTUM GROUP may refuse such deletion when the data subject has a legal or contractual obligation to remain in the database. Revocation of Authorization. Data subjects may revoke the consent granted at any time, except in cases where a legal or contractual provision prevents such revocation. In any case, the data subject must specify in their request whether the revocation is total or partial; the latter applies when the data subject wishes to eliminate only some of the purposes for which the processing was authorized, in which case the data subject must indicate the specific purpose they wish to eliminate.

ENTITY RESPONSIBLE FOR PERSONAL DATA

MENTUM GROUP will be responsible for addressing requests, complaints, and claims submitted by the data subject in exercise of the rights set forth in this policy. The data subject or their authorized representative may submit a request, complaint, or claim Monday through Friday from 8:00 AM to 4:30 PM via email to datospersonales@mentum. group, call the Bogotá landline at +57 +601 508 8877 ext. 57058, or submit it to the following address: Cl. 98 Bis #71D-20.

 TRAINING AND AWARENESS

Training and Awareness MENTUM GROUP will provide periodic training to all employees on the prevention of money laundering and terrorist financing, including the identification of red flags and compliance with current regulations. Additionally, awareness sessions will be conducted on the importance of personal data protection and best practices for its secure handling.

EFFECTIVE DATE

This Personal Data Policy will be reviewed and updated periodically, at least once a year, or whenever there are significant changes to applicable regulations or to MENTUM GROUP’s internal processes. Any changes to this policy will be communicated via email at datospersonales@MENTUM.GROUP and other relevant communication channels.