Timia

Timia
Contact us

Privacy Policy

GENERAL PRINCIPLES AND POSTULATES.

TIMIA COLOMBIA S.A.S., a commercial entity incorporated under Colombian law, with Tax ID No. 901.809.687-1, and headquartered in Medellín, Antioquia, at Calle 12 # 31 – 203. (Hereinafter, “The Data Controller”), guarantees the protection of rights such as the right to data access, privacy, confidentiality, reputation, image, and autonomy. To this end, all actions will be governed by the principles of good faith, legality, data self-determination, freedom, and transparency.

Any person who, in the course of any activity—including commercial and employment activities, whether permanent or occasional—provides any type of personal information or data tothe Data Controller, and where the Data Controller acts as a data processor or data controller, may access, update, and correct such information.

The Data Controller, in order to comply with Law 1581 of 2012 and its Regulatory Decree 1074 of 2015, as well as any other provisions that amend, add to, or supplement them, hereby establishes this Personal Data Protection and Processing Policy, seeking to ensure the protection of personal information provided by data subjects to the Data Controller, such as its shareholders, suppliers, customers, employees, contractors, and any other natural person from whom the Data Controller obtains, collects, processes, retains, uses, or handles personal data, whether such processing is carried out directly by the Data Controller or by third parties acting on behalf of the Data Controller.

IDENTIFICATION OF THE DATA CONTROLLER

For inquiries regarding the processing of your data, you may contact the Data Controller via the following methods:

Company Name: TIMIA COLOMBIA S.A.S.

Tax ID: 901.809.687-1.

Address: Calle 12 # 31 – 203, Medellín, Antioquia.

Email: info@timia.ai

SCOPE OF APPLICATION

This Policy shall apply to all databases containing personal data, regardless of their category (private, semi-private, public, sensitive, and biometric data), that are processed by the Data Controller in its capacity as such; for the purposes of its interpretation, it shall incorporate all the definitions and principles set forth in Articles 3 and 4 of Law 1581 of 2012, Decree 1377 of 2013, and Law 1266 of 2008, as well as any regulations that modify, replace, or supplement them.

The Data Controller, acting in its capacity as such, may request, consult, share, inform, report, process, update, clarify, compile, provide, send, exchange, withdraw, obtain, store, collect, use, delete, and, in general and hereinafter, process the personal data of Data Subjects with whom it has, has had, or expects to have some form of relationship, regardless of its nature, provided that prior authorization has been obtained from the Data Subject and clear measures have been implemented for this purpose to protect the confidentiality and privacy of the Personal Data.  

The Data Controller informs Data Subjects that the provision of sensitive data or data concerning children and adolescents is optional, given the special protection afforded to such data by the Constitution and the law.

LEGAL FRAMEWORK

This policy is governed by the provisions of:

  • Constitution, Article 15.
  • Law No. 1266 of 2008.
  • Law No. 1581 of 2012.
  • Regulatory Decrees No. 1727 of 2009 and No. 2952 of 2010.
  • Partial Regulatory Decree No. 1377 of 2013.

DATA PROCESSING AND PURPOSE

The processing of personal data will include the collection, storage, use, circulation, exchange, transmission, transfer, processing, reproduction, compilation, and deletion of such data, either in whole or in part, in accordance with the purposes set forth herein. The information may be provided, transmitted, or transferred to public entities, business partners, contractors, affiliates, and subsidiaries solely for the purpose of fulfilling the purposes of the corresponding database. In any case, such provision, transmission, or transfer shall be made only after the necessary commitments have been entered into to safeguard the confidentiality of the information. Personal information, including sensitive information, may be transferred, transmitted, or disclosed to third countries that comply with the provisions of current regulations. In this regard, the Data Controller will process personal data exclusively for the purposes authorized and set forth in this Policy, which are listed below:

Employees, partners, and candidates:

  1. Identify and analyze employees' skills to help develop a plan for personal and professional growth within the organization.
  2. Develop strategies and activities to promote personal and family well-being and improve their living conditions.
  3. Learn about and promote the proper use of computer resources, information, and other tangible and intangible assets provided for the performance of their job duties.
  4. Provide personal information to authorities when they lawfully request it.
  5. Manage information security incidents that compromise personal data and/or may violate the rights of the Data Controller, any of its affiliated companies, and/or third parties.
  6. Cooperate with the authorities in the fight against crime in accordance with the obligations imposed by law.
  7. The personal data collected and processed may be stored in physical, video, audio, photographic, biometric, or digital formats, all of which will be securely protected in accordance with the type of personal information.
  8. To fulfill the obligations undertaken bythe Data Controller toward the data subject—whether currently employed or a former employee—regarding the payment of wages, employee benefits, social security contributions, and other contributions specified in the employment contract or as required by law.
  9. Offer corporate wellness programs and organize company activities for the policyholder and their beneficiaries (children, spouse, domestic partner).
  10. Offer personal development and/or training programs, corporate wellness initiatives, and company-sponsored activities for employees and their dependents.
  11. Provide information on the issuance and administration of permits, licenses, and authorizations.
  12. Provide information on prevention, health promotion, and occupational hazards.
  13. Provide information on employment promotion and management, as well as recruitment and selection.
  14. Provide information about data update campaigns and changes in the processing of personal data.
  15. Promote and select staff for positions or job promotions.
  16. Update personal information and any relevant changes regarding the processing of your own data or that of your beneficiaries.
  17. Contact the data subject by any means for statistical purposes or for employee rotation within the company.
  18. Conduct performance evaluations and develop improvement plans.
  19. To inform them of decisions that affect them regarding the company and the roles they play within it.
  20. Communication regarding services and other activities related to the Data Controller’s functions, and fulfillment of obligations to contractors, clients, customers, suppliers, and employees.
  21. Filing complaints, claims, or reports with the relevant authorities or entities in the event of a breach of contract or agreement.
  22. The execution, performance, and termination of contracts.
  23. Handle internal disciplinary or legal proceedings.
  24. Record of information gathered during the performance of the contract.
  25. Processes to ensure the security of the Company's information.
  26. Workplace climate assessment processes and surveys.
  27. Handle all the necessary procedures for the staff selection process and subsequent hiring by the Company.
  28. Submit reports to government agencies as appropriate.
  29. To respond to complaints, claims, or requests.
  30. To provide, transfer, or transmit the data to the parent company, subsidiaries, or affiliates of the Data Controller for the purpose of carrying out the corporate purpose.
  31. To disclose data to third parties acting as data processors when necessary.
  32. To transfer or disclose the information to third parties in connection with due diligence processes, asset sales, or corporate reorganizations.
  33. Use of images for the creation of the Company’s advertising and marketing materials; please be advised that capturing facial images for these purposes involves the collection of sensitive personal data.
  34. To retain personal data for potential recruitment processes.
  35. Conduct the necessary verifications with the Superintendency of Industry and Commerce in order to implement Law 2300 of 2023, also known as the “Stop Scrubbing” Law.

Customers:

  1. Take the necessary steps to further the corporate purpose ofthe Data Controller.
  2. To fulfill the purpose of the service to be provided to the Customer.
  3. Send out invitations to events.
  4. For commercial, administrative, marketing, and sales purposes, such as offering new products or services.
  5. Conduct satisfaction surveys regarding the services provided bythe Data Controller.
  6. Contact the data subject by any means (telephone, email, SMS, or chat) to conduct surveys, studies, and/or verify personal data necessary for the performance of the contractual or business relationship.
  7. Contact the account holder by any means to send information regarding loyalty programs, service improvements, promotions, and advertising campaigns.
  8. Contact the account holder via email or any other means agreed upon by the parties for the purpose of sending statements, account summaries, invoices, and notices regarding collections and/or payments related to the obligations arising from the contract entered into between the parties.
  9. To provide the information to third parties with whom the Data Controller has or may come to have a contractual or business relationship, and to whom it is necessary to disclose such information in order to fulfill the terms of the agreement.
  10. Provide information about data update campaigns and changes in the processing of personal data.
  11. Filing complaints, claims, or reports with the relevant authorities or entities in the event of a breach of contract or agreement.
  12. Contact the account holder by any means for statistical purposes and to track the receipt and dispatch of documents.
  13. To facilitate conversations, service offerings, and consultations using tools such as chatbots.
  14. Generate sales and purchase statistics.
  15. Billing and collection management.
  16. Comply with the requirements of administrative and judicial authorities.
  17. Conduct background checks on business and financial records and check for inclusion on restricted lists, if applicable and in accordance with the law.
  18. Record of entry and exit from the premises.
  19. Quote for potential services based on specific needs.
  20. Analysis of the required services.
  21. Generate transaction histories.
  22. Develop marketing strategies and implement them.
  23. Conduct satisfaction surveys regarding the services provided.
  24. Handle customer service and related matters.
  25. Request and submit quotes.
  26. Send the corresponding payment notification.
  27. Submit accounting and tax information.
  28. Taking photographs and filming while visiting the facilities of the
  29. Sending mass advertising campaigns to promote services provided by the Data Controller and any of its subsidiaries and/or affiliates.
  30. Compliance with legal and tax obligations.
  31. The data provided may be used in marketing strategies carried out by the Data Controller.
  32. Conduct background checks on business and financial records and check for inclusion on restricted lists, if applicable and in accordance with the law.
  33. Submit reports to government agencies as appropriate.
  34. Ensure the safety of people and property within the facility.
  35. To respond to complaints, claims, or requests.
  36. To provide, transfer, or disclose the data to third parties that provide services to the Data Controller for the purpose of performing the contract or contracted service.
  37. To provide, transfer, or transmit the data to the parent company, subsidiaries, or affiliates of the Data Controller for the purpose of carrying out the corporate purpose.
  38. To disclose data to third parties acting as data processors when necessary.
  39. To transfer or disclose the information to third parties in connection with due diligence processes, asset sales, or corporate reorganizations.
  40. Collect, process, verify, transmit, transfer, use, consult, access, and report information regarding the customer’s credit history, as well as commercial and financial information, to credit bureaus, in the event of a breach of financial obligations arising from the business relationship.
  41. Conduct the necessary verifications with the Superintendency of Industry and Commerce in order to implement Law 2300 of 2023, also known as the “Stop Scrubbing” Law.

Suppliers and contractors:

  1. Take the necessary steps to carry out the corporate purpose ofthe Data Controller, as it relates to the fulfillment of the terms of the contract or service order entered into with the data subject.
  2. To fulfill the terms of the contract or service order that binds you to the
  3. Accounting, financial, and business purposes; for informational, marketing, and sales purposes; business performance; and requests for quotes.
  4. Contact the account holder via email to send and issue account statements and invoices related to the obligations arising from the contract entered into between the parties.
  5. Contact the account holder by any means, including email, to process collections and/or payments as appropriate.
  6. Provide information about data update campaigns and changes in the processing of personal data.
  7. Contact the account holder by any means for statistical purposes and to track the receipt and dispatch of documents.
  8. Filing complaints, claims, or reports with the relevant authorities or entities in the event of a breach of contract or agreement.
  9. Security or fraud prevention.
  10. Generate sales and purchase statistics.
  11. Billing and collection management.
  12. Comply with the requirements of administrative and judicial authorities.
  13. Conduct background checks on business and financial records and check for inclusion on restricted lists, if applicable and in accordance with the law.
  14. Submit accounting and tax information.
  15. Compliance with legal and tax obligations.
  16. Ensure the safety of people and property within the facility.
  17. To respond to complaints, claims, or requests.
  18. To provide, transfer, or disclose the data to third parties that provide services to the Data Controller for the purpose of performing the contract or contracted service.
  19. To provide, transfer, or transmit the data to the parent company, subsidiaries, or affiliates of the Data Controller for the purpose of carrying out the corporate purpose.
  20. To disclose data to third parties acting as data processors when necessary.
  21. To transfer or disclose the information to third parties in connection with due diligence processes, asset sales, or corporate reorganizations.
  22. Conduct the necessary verifications with the Superintendency of Industry and Commerce in order to implement Law 2300 of 2023, also known as the “Stop Scrubbing” Law.
  23. Any other purposes that, in the course of fulfilling its mission, require the collection of personal data for processing in accordance with applicable laws.

Sensitive personal data:

Sensitive data refers to data that affects the data subject’s privacy or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political views, religious or philosophical beliefs, membership in trade unions, social organizations, human rights organizations, or organizations promoting the interests of any political party, or those safeguarding the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data, including, among others, still or moving images, fingerprints, photographs, iris scans, voice recognition, facial recognition, or palm recognition, etc.

The Data Controller will process personal data considered sensitive, when necessary, to fulfill its corporate purpose, provided that:

  1. The data subject has given explicit consent to such processing, except in cases where such consent is not required by law or is not necessary given the nature of the data subject’s relationship with the Company.
  2. The processing is necessary to protect the data subject’s vital interests, and the data subject is physically or legally incapacitated; in such cases, the legal representatives or the person providing support must give their consent.
  3. The processing concerns data necessary for the recognition, exercise, or defense of a right in legal proceedings.
  4. The processing is for historical, statistical, or scientific purposes.

With regard to personal data pertaining to children and adolescents, we guarantee that such data will be processed only with the authorization of their legal guardian, for purposes related to social security and the well-being of the child or adolescent.

OWNER'S AUTHORIZATION:

The collection, storage, use, disclosure, or deletion of personal data bythe Data Controller requires the free, prior, explicit, and informed consent of the data subject.

Procedure and requirements for granting authorization.

Consent may be provided in a physical document, an electronic document, a data message, via the Internet, on websites, in any other format that ensures it can be consulted at a later date, or through a suitable technical or technological mechanism that allows consent to be expressed or obtained via a single or double click, through which it can be unequivocally concluded that, had the data subject not taken such action, the data would never have been collected and stored in the database. The authorization shall be generated bythe Data Controller and shall be made available to the data subject in advance and prior to the processing of their personal data.

Proof of authorization.

The Data Controller will use the mechanisms currently at its disposal and will implement and take the necessary steps to maintain appropriate records or technical and technological mechanisms documenting when and how it obtained authorization from the data subjects to process their personal data. To comply with the foregoing, physical files or electronic repositories may be established, either directly or through third parties contracted for that purpose.

Cases in which authorization is not required:

The data subject's consent will not be required in the following cases:

  1. Information requested by a public or administrative entity in the course of its legal duties or pursuant to a court order.
  2. Publicly available data.
  3. Medical or health emergencies.
  4. Processing of information authorized by law for historical, statistical, or scientific purposes.
  5. Data related to the Civil Registry of Persons.

RIGHTS OF CHILDREN AND ADOLESCENTS.

The processing of personal data shall ensure respect for the rights of minors. The processing of minors’ personal data is prohibited, except for data that is in the public domain and data that must be processed for the purpose of hiring employees and contractors.

It is the responsibility of the government and educational institutions of all kinds to provide information and training to legal guardians and caregivers regarding the potential risks minors face due to the improper handling of their personal data, and to educate children and adolescents about the responsible and safe use of their personal data, their right to privacy, and the protection of their own personal information and that of others.

OBLIGATIONS OF TIMIA COLOMBIA S.A.S. AS THE DATA CONTROLLER.

The Data Controller shall bear in mind at all times that personal data belongs to the individuals to whom it relates and that only they may make decisions regarding such data. Accordingly, the Data Controller shall use such data only for the purposes for which it is duly authorized, and shall in all cases comply with applicable laws and regulations regarding the protection of personal data.

Consequently, when TIMIA COLOMBIA S.A.S. acts as the data controller, it will comply with the following obligations:

  1. To ensure that the Data Subject is able, at all times, to fully and effectively exercise the right to access personal data.
  2. Request and retain a copy of the relevant authorization issued by the account holder.
  3. Properly inform the data subject of the purpose of the data collection and the rights to which they are entitled under the authorization granted.
  4. Store the information under the necessary security measures to prevent its alteration, loss, unauthorized or fraudulent access, use, or disclosure.
  5. Ensure that the information provided to the data processor is truthful, complete, accurate, up-to-date, verifiable, and understandable.
  6. Update the information by promptly notifying the data controller of any changes to the data previously provided to them and take any other necessary measures to ensure that the information provided to the data controller remains up to date.
  7. Correct any inaccurate information and notify the data controller accordingly.
  8. Provide the Data Processor, as applicable, only with data whose processing has been previously authorized.
  9. Require the Data Processor to comply at all times with the security and privacy requirements regarding the Data Subject’s information.
  10. Process inquiries and complaints.
  11. Notify the Data Controller when certain information is being disputed by the Data Subject, once the complaint has been filed and the relevant proceedings have not yet been concluded.
  12. Provide information, at the data subject’s request, regarding the use of their data.
  13. Notify the data protection authority in the event of security breaches and when there are risks associated with the management of data subjects' information.
  14. With regard to the international transfer and transmission of personal data, the Company undertakes to process personal data on behalf of the Companies in accordance with the principles governing such data.
  15. With regard to the international transfer and transmission of personal data, it undertakes to safeguard the security of the databases containing personal data.
  16. With regard to the international transfer and transmission of personal data, the Company undertakes to maintain confidentiality regarding the processing of personal data.

NATIONAL DATABASE REGISTRY.

TIMIA COLOMBIA S.A.S. reserves the right, in the circumstances provided for by law and in its bylaws and internal regulations, to classify certain information contained in its databases as confidential in accordance with applicable laws, its bylaws, and regulations, all of which are consistent with the fundamental right to corporate autonomy.

Once TIMIA COLOMBIA S.A.S. meets the legal requirements for registering its databases, it will proceed in accordance with current laws and regulations issued by the National Government for this purpose to register its databases with the National Database Registry (RNBD), which will be administered by the Superintendency of Industry and Commerce. The RNBD is the public directory of databases subject to processing that operate in the country; it will be freely accessible to citizens, in accordance with the regulations issued by the National Government for this purpose.

CONSULTATION AND REPORT TO THE SUPERINTENDENCY OF INDUSTRY AND COMMERCE REGARDING THE IMPLEMENTATION OF LAW 2300 OF 2023 – “STOP SCRUBBING LAW”

TIMIA COLOMBIA S.A.S. is a company committed to respecting citizens’ rights. In this regard, it is taking all necessary steps to comply with the provisions of the “Stop Harassing” Law, which aims to regulate the hours, frequency, and contact channels used by collection agencies and other service providers to protect consumers’ privacy and peace of mind. It allows citizens to register with theDo Not Call Registry (RNE) to avoid receiving unwanted commercial communications. 

In this regard, if the Data Controller needs to conduct advertising campaigns via text messages, phone calls, or emails, it will submit a request to the Superintendency of Industry and Commerce to review the various personal data databases, so that the Superintendency may provide a list of the data subjects who have requested to be excluded in compliance with the “Stop Spamming Act.”

RIGHTS OF THE DATA SUBJECT

In accordance with the provisions of current and applicable regulations regarding the protection of personal data, the data subject has the following rights:

  1. Access, review, correct, and update your personal data with the Data Controller, in its capacity as the entity responsible for processing the data.
  2. By any valid means, request proof of the authorization granted tothe Data Controller in its capacity as Data Controller.
  3. To receive information fromthe Data Controller, upon request, regarding how your personal data has been used.
  4. To file complaints with the competent authorities, particularly the Superintendency of Industry and Commerce, regarding violations of applicable regulations, following a prior consultation or formal request to the Data Controller.
  5. To modify or revoke consent and/or request the deletion of data when the processing does not comply with applicable constitutional and legal principles, rights, and safeguards.
  6. To have access to and review, free of charge, your personal data that has been processed.

These rights may be exercised by:

  1. The account holder, who must provide sufficient proof of identity through the various methods made available by the Company.
  2. The successor(s) of the account holder, who must provide proof of their status.
  3. The account holder's representative and/or authorized agent, upon presentation of proof of representation or power of attorney.

PROCEDURE FOR EXERCISING DATA SUBJECTS' RIGHTS

The Data Controller has designated the Administration Department to handle procedures related to the exercise of rights by data subjects whose personal data will be processed in accordance with this policy.

The rights mentioned in the preceding paragraph may be exercised by the data subjects, their successors in title, or the data subject’s representative and/or authorized agent through the following procedures:

Guarantees of the Right of Access.

 The Data Controller shall guarantee the right of access once the identity of the data subject, the legitimacy of the request, or the capacity of the representative has been verified, by making the relevant personal data available to the data subject, free of charge and in a comprehensive and detailed manner, through any means, including electronic means that allow the data subject direct access to such data. Such access must be provided without any limitations and must allow the data subject to view and update the data online.

Consultation Procedure.

Data subjects, or their legal successors, may access the personal information held about them in any database. Accordingly,the Data Controller shall guarantee the right of access by providing data subjects with all information contained in the individual record or linked to the data subject’s identification.

With regard to the handling of requests for access to personal data,the Data Controller guarantees :

  • Establish electronic or other communication channels as deemed appropriate.
  • Establish simplified forms, systems, and other methods, which must be disclosed in the privacy notice.
  • Use the customer service or complaint handling channels currently in place.

In any case, regardless of the mechanism implemented to handle inquiries, such inquiries will be addressed within a maximum of ten (10) business days from the date of receipt. If it is not possible to address the inquiry within that timeframe, the interested party will be notified before the 10-day period expires, stating the reasons for the delay and indicating the date by which the inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the initial period.

 Claims Procedure.

The data subject, their successors, or representatives who believe that the information contained in the databases should be corrected, updated, or deleted may file a complaint with the Company, which will be processed as described below.

The claim may be filed by the Account Holder, in accordance with the provisions of Article 15 of Law 1581 of 2012 and Decree 1377 of 2013, as well as any other regulations that amend or supplement them.

Which provides that the Data Subject or their successors in title who believe that the information contained in a database should be corrected, updated, or deleted, or who become aware of an alleged breach of any of the obligations set forth in this law, may file a complaint with the Data Controller or the Data Processor, which shall be processed in accordance with the following rules:

  1. The complaint must be filed by submitting a request to the Data Controller or the Data Processor via email, including the data subject’s identification, a description of the facts giving rise to the complaint, the address, and any supporting documents to be submitted. If the complaint is incomplete, the data subject will be requested, within five (5) days of receipt of the complaint, to correct the deficiencies. If two (2) months have elapsed since the date of the request and the applicant has not submitted the required information, it will be understood that the complaint has been withdrawn.If the party receiving the complaint lacks the authority to resolve it, they shall forward it to the appropriate party within a maximum of two (2) business days and inform the complainant of the situation.
  1. Once the complete claim has been received, a note stating “claim pending” and the reason for the claim will be added to the database within two (2) business days. This note must remain in place until a decision is made on the claim.
  1. The deadline for addressing the complaint shall be fifteen (15) business days, starting from the day following the date of receipt. If it is not possible to address the complaint within that period, the complainant will be informed of the reasons for the delay and the date by which the complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial deadline.

Implementation of procedures to ensure the right to file complaints.

At any time and free of charge, the data subject or their representative may request thatthe Data Controller’s staff correct, update, or delete their personal data, provided they first verify their identity.

The rights to correct, update, or delete data may only be exercised by:

  1. The account holder or their successors, upon verification of their identity, or through electronic means that allow them to identify themselves.
  2. Their representative, upon presentation of proof of authorization.

If the request is submitted by a person other than the account holder, that person must provide proper proof of authority or power of attorney to act; if such proof is not provided, the request will be deemed not to have been submitted.

A request for correction, update, or deletion must be submitted through the channels provided bythe Data Controller and must include, at a minimum, the following information: 

  • The name and address of the account holder or any other means of receiving the response.
  • Documents proving the identity or legal status of your representative.
  • A clear and precise description of the personal data regarding which the data subject seeks to exercise any of their rights.
  • If applicable, other information or documents that facilitate the identification of the personal data. 

Claims will be resolved within a period not exceeding fifteen (15) business days, starting from the day following receipt of the claim, which may be extended by an additional eight (8) business days, starting from the expiration of the initial period; in such cases, the Company will inform the Account Holder of the reasons for the extension. 

Correction and updating of data.

The Data Controller is required to correct and update, at the data subject’s request, any information pertaining to the data subject that is found to be incomplete or inaccurate, in accordance with the procedure and terms set forth above. In this regard, the following shall be taken into account:

In requests to correct or update personal data, the data subject must specify the corrections to be made and provide supporting documentation for their request. The data controller has full discretion to implement mechanisms that facilitate the exercise of this right, provided that such mechanisms benefit the data subject. Consequently, electronic or other means deemed appropriate may be implemented.

The Data Controller may establish simplified forms, systems, and other methods, which must be communicated to the Data Subject and made available to interested parties on the website. 

Data deletion.

The data subject has the right, at any time, to request thatthe Data Controller erase (delete) their personal data when:

  1. Please note that they are not being treated in accordance with the principles, duties, and obligations set forth in current regulations.
  2. are no longer necessary or relevant for the purpose for which they were collected.
  3. The period necessary to fulfill the purposes for which the data was collected has expired.

This deletion involves the total or partial removal of personal information, as requested by the data subject, from the records, files, databases, or processing operations carried out bythe Data Controller. It is important to note that the right to erasure is not absolute, and the Data Controller may refuse to grant it when:

  1. The data subject has a legal or contractual obligation to remain in the database.
  2. The deletion of data may hinder judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the enforcement of administrative penalties.
  3. The data is necessary to protect the data subject’s legally protected interests; to carry out an action in the public interest; or to fulfill a legal obligation incumbent upon the data subject.

Revocation of authorization. 

Data subjects may withdraw their consent to the processing of their personal data at any time, provided that no legal or contractual provision prevents them from doing so.

To this end,the data controller must establish simple and free mechanisms that allow the data subject to withdraw their consent, at least through the same means by which it was given.

It should be noted that there are two ways in which consent may be revoked. The first involves all of the purposes for which consent was given; that is,the data controller must completely cease processing the data subject’s data. The second may apply to specific types of processing, such as for advertising or market research purposes. Under the second type—that is, partial revocation of consent—other processing purposes remain unaffected, which the controller may carry out in accordance with the authorization granted and to which the data subject consents.

Submission methods and requirements:

The owner, their representative, or their successors—regardless of the procedure chosen by the petitioner—must include at least the following information:

  • Name of the data subject and/or their representative and/or successors.
  • A copy of the identification document of the account holder and/or their representative and/or their successor.
  • Description of the facts giving rise to the request, inquiry, or deletion of the information.
  • Physical address, email address, and contact telephone number of the owner and/or their representative and/or their successors.
  • Tax ID number, if the entity is a legal entity.
  • Documents they wish to present.
  • Signature, type, and identification number.

The methods available for submitting applications are:

  • Address: Calle 12 # 31 – 203, Medellín, Antioquia.
  • Email: info@timia.ai

Under no circumstances may a Data Subject use verbal or telephone communication to exercise a right protected under Law 1581 of 2012, in order to maintain proof of the request submitted and, secondly, to ensure certainty regarding the date from which the time limits provided for in the Law begin to run for the Data Controller to provide a response to the request submitted by the Data Subject.

Applications that do not meet legal requirements and withdrawal of the claim.

If the claim is incomplete, the interested party will be required, within five (5) business days of receipt of the claim, to remedy, clarify, or correct any inconsistencies; in such cases, the data subject will have a period of two (2) months from the date of the request to rectify their application; otherwise, it will be understood that the applicant has withdrawn the claim. 

INFORMATION SECURITY AND SECURITY MEASURES.

In accordance with the security principle established in current regulations,the Data Controller shall adopt the technical, human, and administrative measures necessary to ensure the security of the records, preventing their alteration, loss, unauthorized or fraudulent consultation, use, or access. 

USE AND INTERNATIONAL TRANSFER OF PERSONAL DATA AND PERSONAL INFORMATION BY TIMIA COLOMBIA S.A.S.

Depending on the nature of the ongoing or occasional relationships that any data subject may have withthe Data Controller,all of their information may be transferred abroad, subject to applicable legal requirements. By accepting this policy, you expressly authorize the transfer of Personal Information. The information will be transferred for all relationships that the Data Controller may establish .

Without prejudice to the obligation to observe and maintain the confidentiality of the information,the Data Controller shall take the necessary measures to ensure that such third parties are aware of and agree to comply with this Policy, on the understanding that the personal information they receive may only be used for matters directly related to their relationship withthe Data Controller, and only for the duration ofthat relationship, and may not be used or intended for any other purpose.

The Data Controller may also share Personal Information with government or other public authorities (including, but not limited to, judicial or administrative authorities, tax authorities, and agencies conducting criminal, civil, administrative, disciplinary, or tax investigations), as well as third parties involved in civil legal proceedings and their accountants, auditors, attorneys, and other advisors and representatives, where necessary or appropriate:

  1. To comply with applicable laws, including laws other than those of your country of residence;
  2. To comply with legal requirements;
  3. To respond to requests from public authorities and government agencies, and to respond to requests from public authorities and government agencies other than those in your country of residence;
  4. To enforce our terms and conditions;
  5. To protect our operations;
  6. To protect our rights, privacy, security, or property, or those of you or third parties;
  7. To obtain the applicable compensation or limit the damages that may affect us.

This Personal Data Processing Policy is effective as of March 13, 2026, and remains in effect indefinitely, in accordance with the corporate purpose of TIMIA COLOMBIA S .A.S.

Any substantial changes to the Personal Data Processing Policies will be promptly communicated to data subjects through the usual contact channels and/or via the website: https://timia.ai/legal