1.OBJECTIVE

This policy is determined in compliance with the requirements established in Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, through which the constitutional right of individuals to know, update, and rectify the information collected about them in databases or archives, and other rights, freedoms, and guarantees related to the protection of personal data are developed. Through this document, the policies for the treatment of information obtained and stored in their files and databases are established.

2.SCOPE

This Personal Data Protection Policy will apply to all databases, documents, and/or files containing Personal Data that are subject to Treatment by LUMINOUS DENTAL AESTHETICS in the legal and due development of its activities, which may involve the transfer of personal information of customers to third parties such as new clients.

3.IDENTIFICATION OF RESPONSIBILITY

The treatment of personal data accessed will be the responsibility of LUMINOUS DENTAL AESTHETICS, which is domiciled in the city of Santiago de Cali at Avenida 6ª Bis 35N-100 Of. 414-415, and which can be contacted through the email address luminousdentalaesthetics@gmail.com and the phones 602 308 7770 - 323 524 9068, or through the website www.luminousdental.com.co in the CONTACT US link. The Customer Service Management is responsible for handling requests, complaints, claims, suggestions, and/or congratulations within LUMINOUS DENTAL AESTHETICS, to whom they can report their concerns at the contact numbers identified in the previous paragraph. The same applies when you want to rectify and/or update personal data if they are inaccurate or to request their elimination when they are considered excessive or unnecessary for the purposes that justified their obtaining or to oppose their Treatment for specific purposes.

4.TERMS, DEFINITIONS, AND PRINCIPLES

• Authorization: Prior, express, and informed consent of the Owner to carry out the Personal Data Treatment.
• Privacy Notice: Verbal or written communication generated by the controller, addressed to the Owner for the Treatment of their Personal Data, through which they are informed about the existence of the Treatment Policies that will be applicable to them, the way to access them, and the purposes of the Treatment that is intended to be given to personal data.
• Database: Organized set of Personal Data that is subject to treatment.
• Clients: Natural or legal person, public or private, with whom LUMINOUS DENTAL AESTHETICS has a commercial relationship. It includes suppliers and clients of the treatments.
• Personal Data: Any information linked or that can be associated with one or more specific or determinable natural persons. Some examples of personal data are: name, ID, address, email, phone number, marital status, health data, fingerprint, etc.
• Sensitive Data: Information that affects the privacy of the Owner or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations, or that promote interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data, among others, capture of fixed or moving image, fingerprints, photographs, iris, voice recognition, facial or palm print, etc.
• Data Processor: Natural or legal person, public or private, who, by himself or in association with others, carries out the Personal Data Treatment on behalf of the Data Controller. In cases where the Controller does not act as the Database Processor, the Processor will be expressly identified.
• Data Controller: Natural or legal person, public or private, who, by himself or in association with others, decides on the Database and/or the Treatment of data.
• Claim: Request from the data subject or authorized persons to correct, update or delete their personal data or to revoke authorization in the cases established by law.
• Terms and Conditions: General framework that establishes the conditions for participants in promotional or related activities.
• Owner: Natural person whose Personal Data is subject to Treatment.
• Transfer: The transfer of data takes place when the Data Controller and/or Processor, located in Colombia, sends the information or personal data to a recipient, who in turn is the Data Controller and is located inside or outside the country.
• Transmission: Treatment of Personal Data that involves the communication of the same within or outside the territory of the Republic of Colombia when its purpose is to carry out Treatment by the Processor on behalf of the Controller.
• Treatment: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation, or deletion.

PRINCIPLES

Principle of legality regarding personal data:

In the use, capture, collection, and processing of Personal Data, current and applicable provisions governing the processing of Personal Data and other related fundamental rights shall be applied.

Principle of freedom:

The use, capture, collection, and processing of Personal Data may only be carried out with the prior, express, and informed consent of the Owner. Personal data cannot be obtained or disclosed without prior authorization, or in the absence of a legal, statutory, or judicial mandate that exempts consent.

Principle of purpose:

The use, capture, collection, and processing of Personal Data to which access is obtained will be subject to a legitimate purpose that must be informed to the respective Owner of the Personal Data.

Principle of truthfulness or quality:

The information subject to use, capture, collection, and processing of Personal Data must be truthful, complete, accurate, updated, verifiable, and understandable. The processing of partial, incomplete, fragmented, or misleading data is prohibited.

Principle of transparency:

The right of the Owner to access, at any time and without restrictions, information about any type of information or personal data of their interest or ownership must be guaranteed in the use, capture, collection, and processing of Personal Data.

Principle of restricted access and circulation:

Personal Data, except for public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to Owners or authorized third parties.

Principle of security:

The Personal Data and information used, captured, collected, and subject to processing shall be protected to the extent that technical resources and minimum standards permit, through the adoption of technological protection measures, protocols, and all kinds of administrative measures necessary to provide security to electronic records and repositories, preventing their alteration, modification, loss, consultation, and, in general, against any unauthorized use or access.

Principle of confidentiality:

All individuals who administer, handle, update, or have access to information of any kind found in Databases or Data Banks undertake to maintain and keep strictly confidential and not disclose to third parties all personal, commercial, accounting, technical, or any other type of information provided in the execution and exercise of their functions. All individuals currently working or who will be linked in the future for this purpose in the administration and management of databases must sign an additional document or another one to their employment or service contract to ensure such commitment. This obligation persists and is maintained even after their relationship with any of the activities involving the Processing has ended.

5. APPLICATION AND PURPOSE

Luminous Dental Aesthetics, as the controller of the personal data it obtains, will use the information for the proper development of its commercial activities, as well as for strengthening its relationships with third parties. Therefore, it collects, stores, uses, circulates, and deletes Personal Data corresponding to natural and legal persons with whom it has or has had a relationship, such as, but not limited to, workers and their families, shareholders, consumers, clients, distributors, suppliers, creditors, and debtors, for the following purposes:

Carrying out promotion, commercialization, and loyalty campaigns for the dental treatments that it is quoting and/or selling.

Sending the information subject to processing to the various entities involved in specific treatments, when it is necessary for the proper fulfillment of the obligations acquired after the pre-contractual purchase agreements have been signed, such as laboratories, providers of dental materials, among others.

Providing the information subject to processing to third parties required to consolidate, promote, verify, and treat the aforementioned information without any limitation.

Evaluating service quality, conducting market studies on consumption habits, and statistical analyses for internal use.

Responding to queries, requests, complaints, and claims made by the data subjects and control agencies and transmitting Personal Data to other authorities that, under applicable law, must receive Personal Data.

Inviting individuals to participate in selection processes and events organized or sponsored by LUMINOUS DENTAL AESTHETICS.

Enrolling LUMINOUS DENTAL AESTHETICS direct employees and personal information of family members in the social security system of the country.

The temporality of the information handling by LUMINOUS DENTAL AESTHETICS corresponds to the one determined as necessary according to each list and its purpose.

6. DATA SUBJECTS' RIGHTS

To know, update, and rectify their personal data in front of the Treatment's controllers or Treatment's processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned data, which lead to error or those whose Treatment is expressly prohibited or has not been authorized in accordance with Law 1581 of 2012 (or failing that, with the regulations that regulate, add, execute, complement, modify, suppress or repeal it).

To file complaints by stating the identification of the information subject, the description of the facts that give rise to the claim, the address, and attaching the documents they wish to assert. If the claim is incomplete, the interested party will be required, within five days following the receipt of the claim, to remedy the deficiencies. If two months have elapsed since the date of the requirement, without the applicant presenting the required information, it will be understood that the claim has been withdrawn.

To request proof of the authorization granted to the controller of the Treatment, except when it is expressly exempted as a requirement for the Treatment, in accordance with the provisions of article 10 of Law 1581 of 2012 (or failing that, with the regulations that regulate, add, execute, complement, modify, suppress, or repeal it) or when the continuity of the treatment has been presented in accordance with article 10 numeral 4 of Decree 1377 of 2013.

To be informed by the Controller or the Processor, upon request, regarding the use given to their personal data.

To file complaints before the Colombian Data Protection Authority for any infringements to the provisions of Law 1581 of 2012 (or, failing that, to the regulations, additions, executions, complements, modifications, suppressions, or derogations thereof). It is necessary to first exhaust the request directly with the Controller or the Processor, in accordance with Article 16 of Law 1581 of 2012.

To revoke the authorization and/or request the deletion of the data when the Treatment does not respect constitutional and legal principles, rights, and guarantees. The revocation and/or deletion shall proceed when the Colombian Data Protection Authority has determined that the Controller or Processor have engaged in conduct contrary to Law 1581 of 2012 (or, failing that, to the regulations, additions, executions, complements, modifications, suppressions, or derogations thereof) and/or to the Constitution. The request for deletion of information and the revocation of authorization shall not proceed when the Owner has a legal or contractual obligation to remain in the database or when the Controller has a legal or contractual obligation to continue with the Treatment.

To access, free of charge, their personal data that have been subject to Treatment. The Owner may consult their personal data free of charge: (I) at least once every calendar month, and (II) every time there are substantial modifications to the information treatment guidelines that motivate them to make new inquiries.

7.PRIVACY NOTICE

Luminous Dental Aesthetics does not sell, supply private information, customer names, or profiles to third parties and will not be used for purposes other than those intended by the user at the time of providing such information.

At Luminous Dental Aesthetics, we are committed to protecting the security of personal information by using the necessary resources to protect the information against access, alteration, loss, consultation, disclosure, use, or unauthorized or fraudulent access.

Luminous Dental Aesthetics does not guarantee the total security of its information and is not responsible for any consequences arising from technical failures or unauthorized access by third parties to the Database or file in which Personal Data are stored.

8.WEB INFORMATION

Graphic representations such as photos, images, designs, among others, are the property of LUMINOUS DENTAL AESTHETICS and may be subject to change without prior notice without implying any liability.

Luminous Dental Aesthetics does not grant the user any license or right to the information or graphic material contained on the website, nor to any other intellectual property rights of Luminous Dental Aesthetics.

9.CHANGES IN POLICIES.

The Treatment policies are available on the website LUMINOUSDENTALAESTHETICS.COM and any changes that occur to them will be communicated through the means provided in Title 3 of this document, without prejudice to the fact that Luminous Dental Aesthetics may make them through another means if it deems it necessary.