Legal
Personal Data Processing Policy
How XIE S.A. collects, uses, retains, and protects the personal data it receives through this website, in accordance with Colombian Law 1581 of 2012.
Personal data processing policy
XIE S.A. adopts this policy in compliance with Statutory Law 1581 of 2012, its implementing regulations compiled in Chapter 25 of Title 2 of Part 2 of Book 2 of Decree 1074 of 2015, and the instructions of the Superintendence of Industry and Commerce (SIC). It applies to the personal data that XIE S.A. collects and processes through its website https://xie.com.co, in particular the data you submit through the contact form, and it explains who the data controller is, what data is processed, for what purposes, what rights you have as a data subject, and how you can exercise them.
Data controller
The controller of your personal data is XIE S.A., identified by Tax ID (NIT) 830061684-1, a company engaged in civil engineering, construction, and infrastructure. Domicile and address: Carrera 11 # 134B-33, Bogotá D.C., Colombia. Email: info@xie.com.co. Phone: +57 601 627 0081. Website: https://xie.com.co.
Definitions
This policy uses the definitions in Article 3 of Law 1581 of 2012 and Article 2.2.2.25.1.3 of Decree 1074 of 2015, including the following: Authorization: prior, express, and informed consent of the data subject to the processing of their personal data. Privacy notice: communication addressed to the data subject informing them of the existence of this policy, how to access it, and the purposes of the processing. Database: organized set of personal data that is subject to processing. Personal data: any information linked or that may be associated with one or more identified or identifiable natural persons. Sensitive data: data that affects the data subject's privacy or whose improper use may lead to their discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, or membership in trade unions or social organizations, as well as data relating to health and sex life, and biometric data. Data processor: person who processes personal data on behalf of the controller. Data controller: person who decides on the database or on the processing of the data. Data subject: natural person whose personal data is subject to processing. Processing: any operation on personal data, such as collection, storage, use, circulation, or deletion. Transfer: sending of personal data to a recipient that, in turn, is a data controller, inside or outside Colombia. Transmission: communication of personal data, inside or outside Colombia, so that a processor may carry out the processing on behalf of the controller.
Principles
XIE S.A. processes personal data in accordance with the principles set out in Article 4 of Law 1581 of 2012: legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security, and confidentiality. Accordingly, it only collects data that is relevant and adequate for the stated purposes, processes it with the data subject's authorization, except as otherwise provided by law, and limits access to it to the people who need it to fulfill those purposes.
Personal data we process
1. Data you enter in the contact form: name, email address, phone number, company or organization, business unit of interest, and message. Fields marked as optional may be left blank. 2. Record of your authorization: the personal data processing authorization and the acceptance of the terms and conditions that you check in the form, with the date and time at which you grant them. 3. Visit data accompanying your message: the site stores in your browser a record of how you arrived at it and sends it along with the form. It includes the page through which you entered and the page from which you are writing, the campaign parameters in links (such as UTM parameters or click identifiers from advertising platforms, when the link contains them), the referring site, the date of your first visit, the language, the approximate country and city (inferred from your internet connection), the device type, the browser, the operating system, the screen resolution, the time zone, and the cookie preferences you have chosen. This data reaches XIE S.A. only if you submit the form. 4. Browsing data for analytics purposes: only if you accept analytics cookies in the cookie notice, data about the use of the site (pages visited, time spent, interactions, and technical device data) is collected through Google Analytics 4. Details are provided in the Cookie Policy.
Purposes of processing
XIE S.A. processes the data above for the following purposes: a) to receive, record, and respond to your message or request; b) to contact you by email or by phone, if you provided it, to address your request, clarify what you need, and follow up; c) to route your request to the XIE S.A. department or business unit related to your interest and, if you so request, to send you information about its civil engineering, construction, and infrastructure services or a proposal; d) to keep a record of the requests received and how they were handled; e) to understand the origin of requests (for example, which page or which campaign generated them) and to prepare internal statistics to improve the site and its content; f) if you accept analytics cookies, to measure the use of the site; g) to protect the security of the site and the form against improper or automated use; and h) to keep proof of the authorization granted, respond to data subjects' inquiries and claims, and comply with requests from the competent authorities. Your data will not be used for purposes other than those described here. Should XIE S.A. need to use it for another purpose, for example to send you newsletters or advertising, it will ask you for a new authorization, as required by Article 2.2.2.25.2.2 of Decree 1074 of 2015.
Sensitive data and data of children and adolescents
XIE S.A. does not request sensitive data through its website. You are not required to provide it, and we ask that you not include it in your message. Nor does it request data of children and adolescents: the form is intended for adults writing on their own behalf or on behalf of a company or organization. If XIE S.A. were to receive data of this type without having requested it, it will process it subject to the restrictions of Articles 5, 6, and 7 of Law 1581 of 2012 and may delete it when it is not necessary to address the request.
Data subject rights
Under Article 8 of Law 1581 of 2012, you have the right to: a) know, update, and rectify your personal data, including with respect to data that is partial, inaccurate, incomplete, fragmented, misleading, or whose processing is prohibited or has not been authorized; b) request proof of the authorization granted to XIE S.A.; c) be informed, upon request, of the use that has been made of your data; d) file complaints with the Superintendence of Industry and Commerce for violations of the law, once the inquiry or claim procedure before XIE S.A. has been exhausted; e) revoke the authorization or request the deletion of your data, which does not apply when you have a legal or contractual duty to remain in the database; and f) access your personal data free of charge. You may consult your data free of charge at least once every calendar month and whenever this policy undergoes substantial changes that give rise to new inquiries (Article 2.2.2.25.4.2 of Decree 1074 of 2015).
Who may exercise these rights
The data subject's rights may be exercised by: (i) the data subject, who must prove their identity; (ii) their successors in interest, who must prove that status; (iii) their representative or attorney-in-fact, upon proof of the representation or power of attorney; and (iv) another person, by stipulation in favor of or for another. The rights of children and adolescents are exercised by those authorized to represent them (Article 2.2.2.25.4.1 of Decree 1074 of 2015).
Responsible department and service channels
Requests, inquiries, and claims regarding personal data are handled by the Management of XIE S.A.. You may submit your request in writing through these channels: Email: info@xie.com.co; we suggest writing “Personal data” in the subject line. Postal mail: Carrera 11 # 134B-33, Bogotá D.C., Colombia, addressed to the Management of XIE S.A.. Phone, for guidance: +57 601 627 0081. So that there is a record of your request and of the response, inquiries and claims must be submitted in writing, by email or by postal mail. Exercising these rights is free of charge, except for the shipping, reproduction, or document certification costs that the law allows to be charged when inquiries exceed one per calendar month.
Procedure for inquiries
You may consult the personal information about you held in the databases of XIE S.A.. The request must state your name, the information you wish to know, and the means by which you wish to receive the response, and must be accompanied by whatever is necessary to verify your identity or your standing. XIE S.A. will respond to the inquiry within a maximum of ten (10) business days from the date of its receipt. When it is not possible to respond within that period, you will be informed of the reasons for the delay and the date on which your inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the first period (Article 14 of Law 1581 of 2012).
Procedure for claims
If you believe that your data should be corrected, updated, or deleted, if you wish to revoke the authorization, or if you notice an alleged breach of the law, you may file a claim, which will be processed in accordance with Article 15 of Law 1581 of 2012: 1. Content: the claim must include your identification, a description of the facts giving rise to it, your address, and any documents you wish to submit. 2. Incomplete claim: if information is missing, you will be asked to complete it within five (5) days following receipt of the claim. If two (2) months pass from that request without you submitting the requested information, you will be deemed to have withdrawn the claim. 3. Referral: if whoever receives the claim is not competent to resolve it, they will forward it to the appropriate party within a maximum of two (2) business days and will inform the interested party accordingly. 4. Notation: once the complete claim has been received, the notation “claim in process” and the reason for it will be entered in the database within no more than two (2) business days, and it will remain until the claim is decided. 5. Response period: the maximum period to address the claim is fifteen (15) business days from the day following the date of its receipt. When it is not possible to address it within that period, you will be informed of the reasons for the delay and the date on which it will be addressed, which in no case may exceed eight (8) business days following the expiration of the first period. 6. Complaint before the SIC: you may go to the Superintendence of Industry and Commerce once you have exhausted the inquiry or claim procedure before XIE S.A. (Article 16 of Law 1581 of 2012).
Data processors and international data transmission
To operate the site and address your request, XIE S.A. relies on technology providers that process the data on its behalf, as data processors: the website hosting, the database in which form messages are stored, the email delivery service used to notify the XIE S.A. team of each new message, and, only if you accept analytics cookies, the Google Analytics service of Google LLC. Those who develop and manage the site on behalf of XIE S.A. also act as processors. The hosting, database, email delivery, and analytics services run on servers located in the United States of America, so the use of the site involves an international transmission of personal data. The United States of America is among the countries with an adequate level of personal data protection according to the Superintendence of Industry and Commerce (section 3.2 of Chapter Three of Title V of its Single Circular) and, in addition, with the authorization you grant in the form, you expressly authorize this transmission. XIE S.A. only provides these providers with the data necessary for the corresponding purpose and requires them to respect the security and confidentiality conditions of the information, in accordance with Article 17 of Law 1581 of 2012 and Article 2.2.2.25.5.2 of Decree 1074 of 2015. Outside of these cases, XIE S.A. does not disclose your data to third parties, except at the request of a public or administrative entity in the exercise of its legal functions, by court order, or with your authorization.
Information security
XIE S.A. adopts reasonable technical, human, and administrative measures to protect personal data against adulteration, loss, and unauthorized or fraudulent consultation, use, or access, in accordance with the security principle in Article 4 of Law 1581 of 2012. These include the following: the site uses encrypted connections (HTTPS), access to form messages is restricted to authorized persons, and we work with providers that offer security controls for their services. Should a breach of the security codes occur that puts data subjects' information at risk, XIE S.A. will report it to the Superintendence of Industry and Commerce, as required by law.
Retention period
XIE S.A. retains personal data only for as long as is reasonable and necessary to fulfill the purposes that justified its processing, taking into account the applicable rules and the administrative, accounting, tax, legal, and historical aspects of the information (Article 2.2.2.25.2.8 of Decree 1074 of 2015). Form data is retained while your request and any business relationship arising from it are being handled, and thereafter for the time required by law or to address any claims; once that time has elapsed, it is deleted. The visit record stored in your browser is automatically deleted 180 days after your first visit, and your cookie preference after approximately 12 months; you can delete them sooner from your browser settings.
Term
Effective date: pending approval. The website contacts database will remain in effect for as long as XIE S.A. keeps its website active and the purposes described in this policy continue to exist, without prejudice to the deletion of each data subject's data when its retention period ends or when a deletion request is granted.
Changes to this policy
XIE S.A. may modify this policy. Substantial changes, especially those relating to the identification of the controller or to the purpose of the processing, will be communicated in a timely manner before they are implemented, by publishing them on this page with the date of the new version and, where applicable, by email to the data subjects whose data is retained. If the change relates to the purpose of the processing, XIE S.A. will request a new authorization (Articles 2.2.2.25.2.2 and 2.2.2.25.3.1 of Decree 1074 of 2015).
Contact
If you have questions about this policy or about the processing of your personal data, write to us at info@xie.com.co, call us at +57 601 627 0081, or send mail to Carrera 11 # 134B-33, Bogotá D.C., Colombia.