Data processing policy

POLICY FOR THE PROCESSING OF PERSONAL DATA

SOCCER STORE SAS has established this privacy and personal data protection policy, which governs the collection, storage, management, and protection of information received from all customers, suppliers, consumers, contractors, debtors, creditors, employees, and related parties. For the purposes of this policy, the following will be taken into account:

DEFINITIONS

Privacy Notice: It is the document that is recorded in any physical, electronic or any other format generated by the person responsible for processing personal data, which is made available to the user for the processing of their personal data.

The privacy notice informs the Data Subject of the existence of these data processing policies that will apply to them, how to access them, and the purposes and rights for the processing of the personal data they provide.

Authorization: It is the prior and express consent of the user to carry out the processing of their personal data.

Database: It is the set of all personal data that has been authorized by its Users and that will be subject to the processing established by this policy.

Personal data: It is any information linked to or that can be associated with a user.

Private data: data that, due to its intimate or reserved nature, is only relevant to the user.

Sensitive data: These are data that affect the user's privacy or whose misuse may generate discrimination based on racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations, or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data related to health, sexual life and biometric data.

Data controller: For the purposes of this policy, SOCCER STORE SAS will handle the personal data of its users in accordance with the law and this document.

Data Controller: is the natural person designated by the person responsible for the processing of personal data (SOCCER STORE SAS ).

Holder: natural person whose information belongs and who has freely and voluntarily expressed to SOCCER STORE SAS your authorization for your personal data to be processed.

Treatment: It is any operation on personal data, such as the collection, storage, use, circulation, modification, clarification or deletion of such data.

PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

As a fundamental premise of this policy, SOCCER STORE SAS respects the privacy of each natural or legal person who provides their personal information through the various information collection channels established for this purpose.

SOCCER STORE SAS guarantees that it has adequate and secure storage mechanisms and systems. The information is collected, processed, and used in accordance with current data protection and privacy regulations. However, SOCCER STORE SAS is not responsible for any consequences arising from unauthorized access by third parties to the database and/or any technical failure in the operation and/or retention of data in the information storage system.

The data provided by the Data Subject must be clear, truthful, verifiable, and accurate so that their processing can be equally reliable. Confidentiality in the processing of personal data is another guiding principle of this policy, as all officials with access to the databases are required to maintain strict confidentiality in their handling of such data.

All data stored and processed by SOCCER STORE SAS must have the prior and express authorization of its owner, which must be granted freely and voluntarily. However, this principle does not require authorization in the following cases: Information requested by a public or administrative entity in the exercise of its legal functions or by court order. Data of a public nature. Cases of medical or health emergencies.

Processing of information authorized by law for historical, statistical, or scientific purposes. Data related to the civil registry of individuals.

Personal data will be included in a database and used for the following purposes: To encode requests for customer and/or supplier affiliation in our systems. To provide information about new products or services. To fulfill obligations to our customers, suppliers, and employees. To achieve efficient communication related to our products, services, offers, promotions, alliances, studies, contests, content, as well as those of our affiliated companies, and to facilitate general access to information about them. To provide our services and products. To provide information about the launch of new products or services, or changes to them. To evaluate service quality. To conduct internal studies on consumer habits. To consult, report, process, and transfer information to credit bureaus.

PROCESSING OF PERSONAL DATA OF MINORS: The processing of data concerning minors must comply with and respect their rights. When processing the personal data of minors, SOCCER STORE SAS will comply with applicable regulations and abide by the rulings of the Constitutional Court on this matter.

SENSITIVE DATA PROCESSING: Since SOCCER STORE SAS collects biometric data, such as surveillance videos, photographs, fingerprints, and others that may be considered sensitive data, it will guarantee that the processing of this information will be carried out seeking to establish mechanisms that improve its customer service processes and in compliance with the provisions contained in Law 1581 of 2012 and Chapter 25 of Decree 1074 of 2015. DUTIES AND RIGHTS 3.1.

Rights of the Data Subject: To know, update, and rectify your personal data with the data controllers or data processors. This right may be exercised, among others, with respect to data that is partial, inaccurate, incomplete, fragmented, misleading, or whose processing is expressly prohibited or unauthorized. To request proof of the authorization granted to the data controller, except when expressly exempted as a requirement for processing, in accordance with the provisions of this policy. To be informed by the data controller or data processor, upon request, regarding the use of your personal data.

Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of the Law. Revoke authorization and/or request the deletion of data when the processing does not respect constitutional and legal principles, rights, and guarantees. Revocation and/or deletion will be required when the Superintendency of Industry and Commerce has determined that, in the processing, the data controller or data processor has engaged in conduct contrary to the Law and the Constitution. Access your personal data that has been processed free of charge.

3.2 Duties of the person responsible for the processing of personal data: Guarantee the Data Subject, at all times, the full and effective exercise of the right to habeas data. Request and retain, under the conditions established by law, a copy of the respective authorization granted by the Data Subject.

Properly inform the Data Subject about the purpose of the collection and the rights to which he or she is entitled by virtue of the authorization granted.

Maintain information under the necessary security conditions to prevent its alteration, loss, unauthorized or fraudulent access, or access. Ensure that the information provided to the data controller is true, verifiable, complete, accurate, up-to-date, verifiable, and understandable.

Update the information, promptly communicating to the data controller any new developments regarding the data previously provided, and adopt any other necessary measures to ensure the information provided remains up-to-date. Correct information when it is incorrect and notify the data controller accordingly.

Demand that the data processor respect the security and privacy conditions of the Data Subject's information at all times. Process inquiries and complaints made by Data Subjects in accordance with the terms established by law. Inform the data processor when certain information is being disputed by the Data Subject, once the complaint has been submitted and the respective process has not been completed. Inform the Data Subject, upon request, about the use of their data. Inform the data protection authority when security code breaches occur and when risks arise in the management of Data Subjects' information.

Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

3.3 Duties of the person in charge of processing personal data : Guarantee the Owner, at all times, the full and effective exercise of the right to habeas data.

Maintain information under the necessary security conditions to prevent its alteration, loss, unauthorized or fraudulent access, use, or consultation. Update, correct, or delete data in a timely manner.

Update the information reported by those responsible for the treatment within five (5) business days from its receipt.
Process queries and complaints made by information holders.
Record the legend "claim in process" in the database when applicable. Insert the legend "information under judicial dispute" into the database once notified by the competent authority of legal proceedings related to the quality of personal data. Refrain from circulating information that is being disputed by the Data Subject and whose blocking has been ordered by the Superintendency of Industry and Commerce.

Allow access to information only to people who are allowed to access it.

Report to the Superintendency of Industry and Commerce when security code violations occur and risks arise in the management of Data Subjects' information. Comply with the instructions and requirements issued by the Superintendency of Industry and Commerce.

AREA RESPONSIBLE AND PROCEDURES FOR DATA CONSULTATION AND FOR THE PRESENTATION OF CLAIMS:
The Marketing department will be responsible for inquiries, complaints, and claims: Data Subjects or their successors in title may consult the Data Subject's personal information stored in the database.
The Data Controller or Data Processor must provide the Data Subject with all information contained in their individual registration or linked to their identification. The request must be made via email and the other contact information listed in the privacy notice published on the website www.cute.store, which is always attached to this policy as Annex 1.
The query will be answered within a maximum period of ten (10) business days from the date of receipt. When it is not possible to answer the query within this period, the interested party will be informed, stating the reasons for the delay and indicating the date on which their query will be answered, which in no case may exceed five (5) business days following the expiration of the first term.

The Data Subject or their successors in title who consider that the information contained in a database should be corrected, updated or deleted, or when they notice the alleged non-compliance with any of the duties contained in the Law, may file a claim with the data controller, through the communication channels established in the privacy notice. For the purposes of filing claims, the following procedure must be followed and the following requirements must be met: The claim must contain at least: the identification of the Data Subject, the description of the facts that give rise to the claim, the address and, accompanying, the documents that they wish to assert. If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to correct the deficiencies. After two (2) months from the date of the request, if the applicant does not present the required information, it will be understood that they have withdrawn the claim. If the person receiving the claim is not competent to resolve it, they will forward it to the appropriate person within a maximum of two (2) business days and inform the interested party of the situation. Once the complete claim has been received, a legend stating "claim in process" and the reason for it will be included in the database within a period of no more than two (2) business days. This legend must remain in effect until the claim is decided.
The maximum term for addressing the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within this term, the interested party will be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

The Owner or successor may file a complaint with the Superintendency of Industry and Commerce once he has exhausted the consultation or claim process with SOCCER STORE SAS

EFFECTIVE DATE: This Personal Data Policy was created on March 15, 2022.

Any changes to this policy will be reported via email: Support@soccerstore10.com