Data controller
In accordance with Colombian Law 1581 of 2012, Decree 1377 of 2013, Decree 1074 of 2015, Decree 1078 of 2015 and SIC Circular 002 of 2015, this information processing policy of Phidias S.A.S. is issued.
Registered name: Phidias S.A.S.
Tax ID (NIT): 830.502.641-7
Registered office: Avenida 4 Norte # 6N-67, office 706, Edificio Siglo XXI, Cali (Valle del Cauca), Colombia
Phone: (571) 508 70 55
Data protection officer: Sebastián Gómez Quinayas
Email: seguridad@phidias.com.co
General definitions
- Consent: the data subject's prior, express and informed consent to the processing of personal data.
- Database: an organized set of personal data that is subject to processing.
- Personal data: any information linked to, or that can be associated with, one or more identified or identifiable natural persons.
- Processor: a person who processes personal data on behalf of the controller.
- Data controller: a person who decides on the database and/or the processing of the data.
- Data subject: a natural person whose personal data is subject to processing.
- Processing: any operation on personal data: collection, storage, use, circulation or erasure.
Personal data held by Phidias S.A.S., whether as controller or as processor, will be processed in compliance with the principles and rules of Law 1581 of 2012, Decree 1377 of 2013 and any other rules supplementing or amending them.
Purposes by database
Personal data held by Phidias S.A.S. will be processed for the following purposes, by database within the data protection programme:
1. Prospective customers
- To keep a record of potential customers and contact them to offer services and/or products.
- To provide information about services, offers, promotions, partnerships, training and content.
- To produce statistical studies, surveys and market trend analysis.
2. Customers
- To maintain and manage the contractual and commercial relationship.
- To send informational messages, requests for information or payment requests.
- To carry out statistical studies and satisfaction surveys.
- To send product and service offers and marketing communications.
- To enforce contracts and validate commercial, tax and corporate reporting.
Processor of schools' data: Phidias acts as “processor” for data collected by its customers (schools) relating to staff, students and family members. Its responsibility is to safeguard that data and ensure its security in terms of availability, integrity and confidentiality. Phidias does not, under any circumstances, collect and/or process this information itself.
3. Recruitment
- To keep a record of potential employees and contractors.
- To identify applicants and contact them through the channels they provide.
- To consider applicants for current or future vacancies.
4. Employees
- To assess suitability and monitor job performance.
- To ensure protection and access control (biometrics, video surveillance, occupational health and safety).
- To manage payroll, social security and payroll-tax contributions, and to comply with legal requirements.
5. Suppliers
- To request quotations and verify documents.
- To update information, monitor contracts and enforce them.
6. Employee fingerprints (security)
- To control staff entry records.
- To control physical access to Phidias premises.
7. Partners and shareholders
- To convene and circulate information about board and shareholder meetings, register with the Chamber of Commerce and sign minutes.
Processing of minors' data
Phidias only processes minors' personal data where it is public in nature or comes from information supplied by employees or contractors when they join, with the prior consent of their legal representatives.
Processing will always respond to and respect the best interests of children and adolescents. Where data is collected by customers (schools), Phidias acts as “processor” and does not, under any circumstances, collect or process that information itself.
Data subject rights
- To access, update and rectify their personal data with Phidias S.A.S.
- To request evidence of the consent given for processing.
- To be informed about the use of their data where no prior consent exists.
- To lodge complaints with Phidias S.A.S. or with the Superintendency of Industry and Commerce (SIC).
- To withdraw consent and/or request erasure of their data, provided no legal or contractual duty requires it to remain in the database.
Requests, complaints and claims
To exercise habeas data rights, the data subject may write to seguridad@phidias.com.co, with the subject line “Protección de datos personales”. The request will be handled by the Information Security Officer together with the legal representative.
Once the request is received, Phidias S.A.S. will respond within the legal term of fifteen (15) business days, extendable by a further eight (8) days with prior notice to the person exercising the right.
Processing principles
- Lawfulness: processing complies with the terms of the law.
- Purpose: data is used solely for the purposes described.
- Transparency: the data subject's right to know what data is collected and how it is processed is guaranteed.
- Security: the required measures are applied to prevent tampering, loss or unauthorized access.
- Confidentiality: information is kept confidential, even after the processing relationship ends.
- Accuracy or quality: information is truthful, complete, accurate, up to date and verifiable.
- Restricted access and circulation: processing is subject to the limits of the law and carried out only by authorized persons.
Security measures
The security measures of Phidias S.A.S. comply with the law to ensure proper processing and minimize the risk of unauthorized access, alteration, erasure, loss or misuse of data, protecting its integrity, availability and confidentiality.
The company has adopted a Comprehensive Personal Data Protection Programme (PIPDP) and an Information Security Management System (ISMS) based on the ISO 27001 standards and the NIST cybersecurity framework, covering the data lifecycle from collection through to deletion.
Controller obligations
- To guarantee the data subject the full and effective exercise of habeas data rights.
- To keep a copy of the consent given by the data subject.
- To state the purpose of collection and the data subject's rights.
- To keep information under appropriate security conditions.
- To keep information truthful, complete, accurate and up to date, and correct it where it is wrong.
- To handle queries and claims and adopt an internal manual of policies and procedures.
- To notify the data protection authority of security breaches and comply with SIC requirements.
Effective date and updates
This document is effective from 9 September 2021. Data will remain in the databases of Phidias S.A.S. for as long as is necessary for the purposes stated.
- 9 September 2021: restructuring of the policy and registration of existing databases and their purposes.
- 9 January 2025: update of the Security Officer's details and of the applicable rules.
Phidias Software S.L. (Spain — GDPR)
Registered name: Phidias Software S.L.
Tax ID (NIF): B85958262
Address: C. Jorge Juan 4, casa 26, 28669, Monte Las Encinas (Madrid)
Email: juan.cortes@phidias.es
Phone: (+34) 919 038 772
Your data will be incorporated into the processing system owned by Phidias Software S.L. The purposes, retention periods and legal bases are:
Data subject rights
You may exercise your rights of access, rectification, restriction, erasure, portability and objection, and withdraw consent, by writing to the postal address given above or to juan.cortes@phidias.es, enclosing proof of identity. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).
This document reproduces the data processing policy of Phidias S.A.S. (Colombia) and the privacy policy of Phidias Software S.L. (Spain). This is a courtesy translation; for legal purposes the official Spanish text published by Phidias prevails.