+57 318 282 62 95 informacion@proquimes-sa.com

Home
Our products
About us
Contact us

Select page

Contact us

How to get to our plant

We appreciate your interest in Proquimes S.A. To learn more about our products, request samples and technical inquiries, please fill out the following form:

Name

Last Name

Email

Telephone

Company

Position

Message

I have read and accept the Personal Data Processing Policy

+57 318 282 62 95

informacion@proquimes-sa.com

Carrera 5 Norte # 52 – 61
Postal code: 760002
Cali, Colombia

• Personal Data Processing Policy

© 2025 Proquimes S.A. All rights reserved. Design by ntropik

Personal Data Processing Policy

OBJECTIVE
This Personal Data Processing Policy (hereinafter the "Policy") aims to regulate the collection, storage, use, circulation, and deletion of personal data within SOCIEDAD PROQUIMES S.A. (hereinafter "PROQUIMES S.A."), providing tools to ensure the authenticity, confidentiality, and integrity of the information.
The Policy is structured in accordance with the mandates of Statutory Law 1581 of 2012, the relevant decrees, and any regulations that complement, amend, or repeal it.

SCOPE
The Policy of PROQUIMES S.A. covers all administrative, organizational, and control aspects that must be complied with by executives, employees, contractors, and third parties who work with or maintain a direct relationship with the Company.
This Policy is to be integrated with the Information Security Policy Manuals and the Information Asset Management Manuals.

LEGAL FRAMEWORK OF THE POLICY
• Law 1581 of 2012, through which the General Regime for the Protection of Personal Data was issued.
• Decrees and external circulars that regulate the norm indicated in the previous numeral.
• Constitutional Court Ruling C–748 of 2011, through which the Statutory Law Project for the Protection of Personal Data was declared constitutional.

POLICY DEVELOPMENT
PROQUIMES S.A. incorporates respect for the protection of personal data in all its actions. Consequently, from the moment data is received, authorization will be requested for the use of such information for purposes aligned with the company’s mission.
PROQUIMES S.A. respects the principles established by law and will observe in its actions and handling of personal data the purposes derived from the collection of such data.
PROQUIMES S.A. will implement the strategies and necessary actions to enforce the rights established in Statutory Law 1581 of 2012 and other complementary, modifying, or repealing regulations.
PROQUIMES S.A. will inform all users of the rights derived from the protection of personal data.

STRATEGY
5.1 DATA PROCESSING
To ensure the proper handling and protection of personal data, PROQUIMES S.A. will oversee the management of such data in three areas through designated data managers. These managers will carry out activities in accordance with this Policy and for the purpose of developing processes related to the use, processing, collection, and protection of data, pursuant to Law 1581 of 2012 and other applicable regulations. The identified areas are:
• Marketing area.
• Human Resources Area
• Purchasing and Logistics Area
5.2 DATA PROCESSING RESPONSIBLES
The heads of each of the areas mentioned in section 5.1 of this Policy, or their appointed delegates, shall be responsible for the processing of data. These individuals will have access to and will handle the databases where personal data collected from third parties by PROQUIMES S.A. is stored.
5.3 INFORMATION SECURITY COMMITTEE
The Information Security Committee will be composed of three members: the Marketing Coordinator, the Human Resources Assistant, and the Purchasing and Logistics Assistant, who are each responsible for data processing in their respective areas. The committee members will be coordinated by the person designated as the Information Security Officer.
5.4 INFORMATION SECURITY OFFICER
The Administrative and Marketing Director, or their temporary delegate, will serve as the Information Security Officer and will coordinate the Information Security Committee. This officer will ensure compliance with this Policy within organizational activities and will oversee, through the committee, the training, dissemination, and scope of the Policy.
The Officer and the Information Security Committee shall be responsible for decisions related to the updating, modification, application, and implementation of this Policy.
5.5 DISSEMINATION AND TRAINING
PROQUIMES S.A. will define the processes for dissemination and training related to the content of this Policy through its Information Security Committee.
5.6 INTERNAL ORGANIZATION AND RISK MANAGEMENT
PROQUIMES S.A. will define any action related to the protection of personal data within its Information Security Committee. Among the members of this committee, one person will be assigned to fulfill the role of Personal Data Protection Officer.

DEFINITIONS
For the purposes of this document, the following terms and definitions apply:
• Privacy Notice: Verbal or written communication generated by the party responsible for processing personal data, addressed to the Data Subject, which informs them about the existence of applicable data processing policies, how to access them, and the purposes for which their personal data will be used.
• Authorization: Prior, express, and informed consent granted by the Data Subject for the processing of their personal data.
• Databases: An organized collection of personal data that is subject to processing.
• Personal Data: Any information linked or that may be associated with one or more natural persons determined or determinable. "Personal data" should then be understood as information related to a natural person (individual person considered).
• Public Data: This data is not semi-private, private or sensitive. Public data are considered, inter alia, data relating to the civil status of persons, their profession or trade and their quality as a trader or public servant. By their nature, public data may be contained, inter alia, in public records, public documents, gazettes and official bulletins, and duly executed court decisions that are not subject to reservation.
• Sensitive Data: It corresponds to the data that affects the privacy of the Holder or whose abuse may result in his discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties as well as data relating to health, sexual life and biometric data.
• In charge of processing: a natural or legal person, public or private, who, by himself or in association with others, conducts the processing of personal data on behalf of the controller.
• Responsible for the Treatment: a natural or legal person, public or private, who by himself or in association with others, decides on the basis of data and / or the processing of data.
• Holder: a natural person whose personal data are processed.
• Transfer: The transfer of data takes place when the person responsible for and / or in charge of the processing of personal data, located in Colombia, sends the information or personal data to a recipient, who is in turn responsible for the processing and is inside or outside the country.
• Transmission: The processing of personal data involving the communication of such data within or outside the territory of the Republic of Colombia when it is intended to carry out a processing by the person responsible for the account of the person responsible.
• Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation or suppression.
• Data Protection Officer: It is the role within PROQUIMES S.A., which will have as its function the monitoring and control of the Policy under the control of the Security Committee.

RECTORS PRINCIPLES
• The principle of Legality in data processing: Data processing is a regulated activity that must be subject to the provisions of the law and other provisions that develop it.
• Principle of Purpose: Treatment must be based on a legitimate purpose in accordance with the Constitution and the law, which must be informed to the Holder.
• Principle of Freedom: Treatment can only be exercised with the prior, express and informed consent of the Holder. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate to redeem consent.
• Veracity or Quality Principle: The information subject to treatment must be accurate, complete, accurate, up-to-date, verifiable and understandable. The processing of partial, incomplete, fractional or misleading data is prohibited.
• Transparency principle: In processing, the right of the Holder to obtain information on the existence of data concerning the person responsible for such treatment or of the person responsible for such treatment, at any time and without restrictions, must be guaranteed.
• Restringed Access and Circulation Principle: The treatment is subject to the limits that arise from the nature of personal data and from constitutional and legal provisions. In this regard, treatment may be carried out only by persons authorized by the Holder and / or by the persons provided for in the Act. Personal data, except public information, may not be available on the Internet or other mass media, unless access is technically controllable to provide limited knowledge only to holders or third parties authorized under the said law.
• Security principle: Information subject to treatment by the person responsible for the treatment or treatment referred to in the law shall be handled by such technical, human and administrative measures as are necessary to provide security to the records, and to prevent their adulteration, loss, consultation, use or unauthorized or fraudulent access.
• Principle of Confidentiality: All persons involved in the processing of personal data that do not have the nature of the public are required to ensure the reservation of the information, even after the completion of their relationship with one of the tasks involved in the processing, and may only provide or communicate personal data where this corresponds to the conduct of the activities authorized by the Act and in the terms of the Act.

SPECIAL DATA CATEGORIES
8.1 SINSIBLE PERSONAL DATA
Sensitive data are data that affect the privacy of the holder or whose abuse may result in discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties as well as data relating to health, sexual life and biometric data.
PROQUIMES S.A. will restrict the processing of personal data sensitive to the strictly indispensable and will seek prior and express consent on the purpose of its processing.
8.2 PROCESSING OF SENSITIVE PERSONAL DATA
The use and processing of data classified as sensitive may be carried out when:
• The holder has given his express authorisation to such treatment, except in cases where, by law, such authorisation is not required.
• The treatment is necessary to safeguard the vital interest of the Holder and he is physically or legally incapacitated. In these events, the legal representative (s) shall grant their authorisation.
• The processing refers to data necessary for the recognition, exercise or defence of a right in a judicial process.
• The treatment has a historical, statistical or scientific purpose, or within the framework of improvement processes, provided that the measures leading to the removal of the identity of the holders are taken.
8.3 PERSONAL DATA OF CHILDREN AND ADOLESCENTS
Minors are the holders of their personal data and are therefore entitled. In accordance with the Constitution and in accordance with the Code on Children and Adolescents, the rights of minors must be interpreted and applied in a prevailing manner. They should therefore be observed with special care. As stated in Decision C-748 of 2011, the views of minors should be taken into account when processing their data.
PROQUIMES S.A. then undertakes, in the processing of personal data, to respect the prevailing rights of minors. The processing of personal data of minors is prohibited, except for data of a public nature.

CLASSIFICATION OF INFORMATION AND DATA BASES
The databases are classified as follows:
9.1 CONFIDENTIAL DATABASES
They are databases or electronic files with confidential information which deals with the business model of PROQUIMES S.A., is the case of financial data, staff databases, databases with sensitive information about managers, suppliers, formulas, research, processes, procedures and R & D projects In general, reference is made to database contentiva information related to the Know how and the operativeness of PROQUIMES S.A.
9.2 DATA BASES WITH SSENSIBLE INFORMATION
These are data that affect the privacy of the incumbent or whose abuse may result in his or her discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties as well as data relating to health, sexual life and biometric data.
In PROQUIMES S.A., access to this type of information is restricted and will only be known by an authorized group of officials.
9.3 DATABASES WITH PUBLIC INFORMATION
These include data that affects the privacy of the Data Subject or that, if misused, could result in discrimination. This encompasses data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social or human rights organizations, or political parties, as well as information related to health, sexual life, and biometric data. At PROQUIMES S.A., access to this type of information is restricted and will only be known to an authorized group of employees.

OBLIGATIONS AND RIGHTS OF NICLEAR
Personal data holders have the following rights:
• Access, know, update and correct your personal data against PROQUIMES S.A. as the controller.
• By any valid means, apply for the authorization granted to PROQUIMES S.A., except for cases in which the Act excludes the authorization.
• Request information from PROQUIMES S.A., upon request, regarding the use it has given to your personal data.
• To come to the legally constituted authorities, in particular to the Superintendency of Industry and Commerce (SIC) and to file complaints for violations of the provisions of the current regulations, after consultation or request with the person responsible for the treatment.
• Amend and revoke the authorisation and / or request the deletion of personal data where the existing constitutional principles, rights and guarantees are not respected in the processing.
• Be aware and have free access to your personal data that has been processed.

DEBERS OF PROQUIMES SA IN RELATION TO THE TREATMENT OF PERSONAL DATA
PROQUIMES S.A., will bear in mind that the personal data are the property of the persons to which they refer and that only they can decide on them. PROQUIMES S.A. will use such data only for the activities of the ordinary turn of the society within its social object and the legal relations with its contractors, customers, employees and / or suppliers, in any case subject to the current regulations on the protection of personal data (Law 1581 of 2012 through which the General System for the Protection of Personal Data was issued).

INFORMATION TREATMENT POLICIES
12.1 GENERAL PROVISIONS ON AUTHORIZATION
PROQUIMES S.A. will request authorization for the processing of personal data by any means that can serve as proof. Depending on the case, this authorization may be part of a broader document—such as a contract—or a specific document for this purpose. In any case, the purpose of data processing will be described in the same or an attached document. PROQUIMES S.A. will inform the Data Subject of the following:
• Specific request for the required data.
• The processing to which your personal data will be submitted and the purpose of this.
• The rights that assist you as a titular.
• The channels in which you can make consultations, requests and / or claims.
12.2 GUARANTEES FOR THE RIGHT OF ACCESS
PROQUIMES S.A. will guarantee the right of access, provided that the identity of the Data Subject, their legal authority, or the representation of their proxy is duly verified. The company will make available, free of charge and in a detailed manner, the relevant personal data.
12.3 INQUIRIES
The holders of the personal data or their causes may request the personal data which they rest in the database of PROQUIMES S.A.. Accordingly, PROQUIMES S.A. shall guarantee the right of consultation by providing the Personal Data Holders with all the information contained in the individual register or linked to the identification of the Personal Data Holders.
With regard to the treatment of requests for personal data, PROQUIMES S.A. guarantees:
• Enable electronic or other means of communication that it considers relevant.
• Establish forms, systems and other methods.
• Use the customer care services or claims that are in operation.
Regardless of the mechanism that is implemented for the care of requests for consultation, they will be met within a maximum of 10 (10) working days from the date of their receipt. In the event where a request for consultation cannot be met within the period referred to above, the person concerned shall be informed before the expiry of the period of time the reasons why no response has been given to his consultation, which may in no case exceed five (5) working days after the expiry of the first term.
The consultations with respect to personal data must be sent by e-mail to the following protective address -de-data @ proquimes-sa.com.
12.4 COMPLAINTS
The Data Subject or their successors may file a complaint with the Data Controller if they believe that the data contained in a database should be corrected, updated, or deleted, or if they notice a potential breach of any legal obligations related to personal data protection.
Complaints must be submitted by completing the “Personal Data Processing Complaint Form,” which can be requested by emailing: proteccion-de-datos@proquimes-sa.com. In this form, the Data Subject must indicate whether they wish their data to be updated, corrected, deleted, or if they wish to revoke their authorization. For complaints, the provisions of Article 15 of Law 1581 of 2012 must be considered.
If the claim is incomplete, the Holder may complete it within five (5) working days of the receipt of the If the complaint is incomplete, the Data Subject will have five (5) business days to complete it. If after two (2) months the required information is not provided, it will be understood that the complaint has been withdrawn.
If the person who receives the complaint is not competent to resolve it, they must forward it to the appropriate party within two (2) business days and inform the interested party accordingly.
Once the complete complaint is received, the maximum response time will be fifteen (15) business days from the next business day after receipt. If the complaint cannot be resolved within this period, the reasons for the delay and the expected response date will be communicated. The new date may not exceed eight (8) business days after the initial deadline.
PARAGRAPH 1: In the event that between PROQUIMES S.A. and the claimant measures a validly concluded contract or legal act that is in force the application shall be denied.
12.5 RECTIFICATION AND UPDATE OF DATA
PROQUIMES S.A. may rectify and update, at the request of the Data Subject, the information that turns out to be incomplete or inaccurate, in accordance with the procedure and terms previously indicated. In this regard, PROQUIMES S.A. will take into account the following:
• In requests for rectification and updating of personal data, the holder must indicate the corrections to be made and provide the documentation to be endorsed.
• PROQUIMES S.A. is fully free to enable mechanisms to facilitate the exercise of this right, provided that it does not harm the Data Holder. Therefore, electronic means or other means that PROQUIMES S.A. considers relevant may be enabled.
• PROQUIMES S.A. may establish forms, systems and other methods, which will be made available to interested parties on the website or request them by email to the protective address -de-data @ proquimes-sa.com.
12.6 DELETION OF DATA
The Data Subject may request PROQUIMES S.A. the deletion (elimination) of their personal data when:
• It considers that these are not being treated in accordance with the principles, duties and obligations provided for in the current legislation.
• They have ceased to be necessary or relevant for the purpose for which they were collected.
• The period necessary for the fulfilment of the purposes for which they were collected has been exceeded.
The deletion implies the total or partial elimination of personal information as requested by the Data Subject in the records, files, databases, or treatments carried out by PROQUIMES S.A.
The right to deletion is not an absolute right, and the data controller may deny its exercise when:
• The Data Holder has a legal or contractual duty to remain in the database.
• The elimination of data impedes judicial or administrative proceedings related to tax obligations, the investigation and prosecution of offences or the updating of administrative sanctions.
• The data are necessary to protect the legally protected interests of the Holder in order to take action in the public interest or to comply with an obligation legally acquired by the Holder.
12.7 REVOCATION OF AUTHORIZATION
Any data subject may revoke, at any time, their consent to the processing of their personal data, provided that a legal or contractual provision does not prevent it. To this end, PROQUIMES S.A. will establish simple mechanisms that allow the Data Subject to revoke their consent.
There are two modalities in which consent revocation can occur
• On the whole of consented purposes, that is, that PROQUIMES S.A. must stop processing the Titular data completely.
• For certain agreed purposes such as advertising or market studies. In this case, PROQUIMES S.A. must stop partially processing the Titular data. Other treatment purposes are then maintained which the person responsible may, in accordance with the authorization granted, carry out and with which the Holder agrees.
12.8 CONTRACTS
In employment contracts, PROQUIMES S.A. will include clauses in order to authorize, in advance and generally, the processing of personal data related to the execution of the contract, including the authorization to collect, modify, or correct, in the future, the personal data of the holder. It will also include authorization for some of the personal data, if applicable, to be accessed by third parties with whom PROQUIMES S.A. has service provision or other types of contracts, for the performance of tasks related to the contract. These clauses will mention this Policy.
In contracts with third parties, when the contractor requires personal data, PROQUIMES S.A. will provide such data only when there is prior and express authorization from the data subject for this transfer. In these cases, since the third parties are data processors, their contracts will include clauses that specify the purposes and treatments authorized by PROQUIMES S.A., and precisely define the use that such third parties may make of the data.
12.9 TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
The transfer of personal data to third countries will only be carried out when there is corresponding authorization from the Data Subject.

GENERAL REGULATIONS APPLICABLE
PROQUIMES S.A. establishes the following general rules for the protection of personal and sensitive data, as well as for the care of databases, electronic files, and personal information:
• PROQUIMES S.A. shall ensure the authenticity, confidentiality and integrity of the information.
• The Security Committee shall be responsible for implementing and designing the strategy for the implementation of this Policy.
• PROQUIMES S.A. will take all necessary technical measures to ensure the protection of existing databases. Where infrastructure is dependent on a third party, it shall be ensured that the availability of information such as the care of personal and sensitive data is a fundamental objective.
• Regular audits and controls will be carried out to ensure the correct implementation of Law 1581 of 2012 and its regulatory decrees.
• It is the responsibility of employees and collaborators, contractors, shareholders and board members of PROQUIMES S.A. to report any incidents of information flight, computer damage, personal data violation, data marketing, use of personal data of children or adolescents, identity supplanting, or conduct that may violate a person's privacy.
• PROQUIMES S.A., in order to ensure the protection of personal information, shall adopt, in its transactional portals, all mechanisms to ensure the confidentiality of the information. For this you can adopt technological security mechanisms such as security software, digital signatures, SSL certificates, Hypertext Transfer Protocol Secure (HTTPS), such as the tools needed to save and protect the entity's databases.
• The training and training of staff, suppliers and contractors will be a key complement to these policies.
• The Data Protection Officer shall identify and promote the authorization of the Owners, privacy notices, notices on the entity's website, awareness-raising campaigns, claim legends and other procedures to comply with Law 1581 of 2012 and other regulations that complement, modify or repeal it.

FUNCTION OF THE PROTECTION OF PERSONAL DATA TO THE INTER OF PROQUIMES S.A.
14.1 RESPONSIBLE PARTIES
Responsible for the processing of personal data «a natural or legal person, public or private, who decides on the basis of data and / or data processing». In this way, the person responsible is the one who defines the purposes and means of processing personal data and ensures compliance with the requirements of law.
In the case of PROQUIMES S.A., the person responsible for adopting the necessary measures for the proper processing of personal data is the Data Protection Officer.
14.2 PROCESSORS
A Processor of personal data is "the natural or legal person, public or private, who processes personal data on behalf of or at the instruction of the responsible party." This means that for each data processing activity, the respective processors must be identified, and they must act under the precise instructions of a responsible party.
14.3 PROCESSORS' DUTIES
PROQUIMES S.A. distinguishes between Internal Processors and External Processors. Internal Processors are employees and collaborators of PROQUIMES S.A., while External Processors are natural or legal persons who process data provided by the entity to perform an assigned task (suppliers, consultants, etc.).
14.4 INTERNAL DEPLOYMENT OF THE DATA PROTECTION POLICY
Upon adopting this Policy, PROQUIMES S.A. will establish:
• Terms and conditions of use of external computer tools: Self-regulation of the principles and rules enshrined in Law 1581 of 2012, specifically aimed at protecting the right of habeas data from customers, users and in general any natural person who interacts with a computer application (element that manages information either physical or electronic).
• Data Protection Officer: In compliance with the legal duty enshrined in article 17 of Law 1581 of 2012, on the need to assign direct responsibilities to a subject within the Organization, the role of Personal Data Protection Officer is created, in the head of the Information Security Officer or designated by the Information Security Officer and is a member of the Information Security Committee, who, taking into account the requirements of the Security Committee, will articulate all actions for the effective implementation of the Personal Data Protection Policy in PROQUIMES S.A..
The main obligations of the Security Committee are as follows:
1. To ensure, at all times, the full and effective exercise of the right of habeas data.
2. To request and keep, under the conditions provided for in this Law, a copy of the respective authorisation granted by the Holder.
3. To inform the Holder of the purpose of the collection and of the rights provided for by the authorization granted.
4. Keep the information under the security conditions necessary to prevent their unauthorised or fraudulent adulteration, loss, consultation, use or access.
5. Ensure that the information provided to the controller is accurate, complete, accurate, up-to-date, verifiable and understandable.
6. To update the information, by communicating in a timely manner to the controller, all developments with respect to the data previously provided to him and to take the other measures necessary to keep the information provided to him up to date.
7. Rectify the information when incorrect and report the relevant to the controller.
8. To provide the controller, as the case may be, with only data whose treatment is previously authorized in accordance with the law.
9. Require the controller at all times to respect the security and privacy protocols of the holder's information.
10. To process the consultations and claims made in the terms specified in the law.
11. To inform the controller when certain information is under discussion by the Holder, after the complaint has been filed and the respective proceedings have not been completed.
12. Inform at the request of the Holder the use given to your personal data.
13. Inform the data protection authority (SIC) when there are violations of the security codes and risks in the administration of the information of the holders.
14. To comply with the instructions and requirements of the Superintendency of Industry and Trade (SIC).

THE NATIONAL DATA BASIS REGISTRATION
According to the provisions of Decree 886 of 2014, which regulates Article 25 of Law 1581 of 2012, PROQUIMES S.A. will independently register in the National Database Registry each of the databases containing personal data processed by the Company (Articles 2 and 3 of Decree 886 of 2014), identifying each of these databases according to the purpose for which they were created (Article 9 of Decree 886 of 2014).
In the registration of the databases, PROQUIMES S.A. will indicate its corporate name, tax identification number, as well as its location data and contact information of the responsible person.
PROQUIMES S.A. will also indicate in the National Database Registry the corporate name, tax identification number, location, and contact information of the Data Processors (Article 7 of Decree 886 of 2014).
Finally, PROQUIMES S.A. must update the information registered in the National Database Registry when substantial changes occur.

VIGENCE AND ACTUALIZATION
This Policy comes into effect upon its approval by the Information Security Committee, and its update will depend on the instructions of said Committee.
Actions aimed at the protection of personal data within the Information Security Committee will be articulated, which will carry out semi-annual reviews of the proper execution of the Policy jointly with the Company's Data Protection Officer.
The approved version of this Policy will be published on the official website of PROQUIMES S.A.
It is the duty of PROQUIMES S.A. employees and collaborators to be familiar with this Policy and take all necessary actions for its compliance, implementation, and maintenance.
This Personal Data Protection Policy was approved in the session of the Security Committee of PROQUIMES S.A. on the second (02) day of the fifth (05) month of the year two thousand twenty-three (2023).