POLICIES

1. CURRENT REGULATIONS

This Information Processing Policy is governed by the provisions of Law 1581 of 2012 and regulatory decree 1377 of 2013 and other rules that modify them. It will be published on the website www.mambogota.com.

2. OBJECTIVE

To inform the holders of the personal data database of the MUSEUM OF MODERN ART OF BOGOTA about the policy on processing personal data, in accordance with the applicable legal provisions.

3. SCOPE

This Personal Data Protection Policy will apply to all Databases and/or Files containing Personal Data that are the subject of Processing by the MUSEUM OF MODERN ART OF BOGOTA, each individually considered as the Controller of Personal Data, (hereinafter “EL MAMBO”).

4. IDENTIFICATION OF THE CONTROLLER OF PERSONAL DATA

THE MUSEUM OF MODERN ART OF BOGOTA, NIT No. 860.021.720-5, with main address at CLL 24 No. 6-00 in the city of Bogota, e-mail: info@mambogota.com, informs its Policy for the Treatment of Personal Data.

5. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA

The protection of personal data for MAMBO is governed by the following principles, and processes are developed on the basis thereof, internal rules, policies and procedures for the processing of personal data (collection, handling, use, storage and exchange of personal data).

5.1. Principle of restricted access and movement.

In accordance with the legal provisions, the personal data collected or processed by the company are considered as semi-private and are intended to be used only in the context of the purpose and authorization granted by the holder of the personal data. Access and circulation will be restricted according to the nature of the data and with the authorizations given by the Holder, its representatives or those provided for in the Law.

Personal data, except those of a public nature, shall not be available on the internet or other means of dissemination or mass communication, unless access is technically controllable to provide limited knowledge to Holders or authorized third parties.

5.2. Principle of confidentiality

According to the above definition, MAMBO guarantees the confidentiality of data depending on the nature of the data. Therefore, we will keep the information reserved during and after the activities that justify the processing of personal data.

5.3. Principle of purpose

It will be legitimate, informed and material. The purpose corresponds to the functions under which MAMBO will process the personal data that are collected.

The processing of personal data that MAMBO carries out, obeys to the legitimate purpose according to the Political Constitution, the Law 1581 of 2012 and the Decree 1377 of 2013.

5.4. Principle of legality

MAMBO will process the data collected for legitimate purposes such as support for the registration of commercial transactions, and accountants of each company and those subject to Law 1581 of 2012.

The Processing of Personal Data will be an activity regulated and governed by the Statutory Law 1581 of 2012, the Decree 1377 of 2013 and other regulations that complement them, modify or repeal.

5.5. The principle of freedom

MAMBO guarantees the right to informational self-determination and authorization by the owners to provide personal data.

MAMBO may process and share personal data stored in its databases without the prior consent of the holder, provided that they are public records or are in databases excluded by law (e.g. for journalists, statistics and research). In other cases, MAMBO must obtain the prior, express and informed consent of the Data Controller when processing his personal data.

5.6. The safety principle

MAMBO as the data controller and/or processor of personal data, provides technical measures, The Commission has also adopted a number of measures to ensure that the data collected in the course of the year is not used by third parties.

5.7. Principle of transparency

MAMBO guarantees that the data subjects, who may obtain at any time, free of charge and without restriction, information about the existence of data concerning you and stored in Mambo databases under the parameters set out in article 21 of Regulatory Decree 1377 from 2013.

5.8. Principle of truthfulness or quality

MAMBO guarantees that the information contained in the databases being processed will be truthful, complete, accurate, up-to-date, verifiable and understandable.

The accuracy and quality of personal data that have been captured by means of forms or documents is guaranteed by each of the holders of it, The MAMBO is not responsible for its quality.

6. US OF PERSONAL INFORMATION

6.1. Private or semi-private data

The semi-private data is that which has no intimate nature, The information on the financial and credit data may be of interest not only to the holder but also to a certain sector, individuals or society in general.

For MAMBO, it is integrated to the concepts of Private and Semi-private Data and these are characterized in the information provided by the person to give flow to the operations of the Museums:

MAMBO will use and process sensitive data when

The processing has been expressly authorized by the Data Holder except in cases where by law, such authorization is not required.
The Processing refers to data that is necessary for the recognition, exercise or defense of a right in a judicial process;
The data provided by the holders shall be used to deal with the commercial, accounting and tax operations of the entities.

In addition to the above, MAMBO will inform at the time of collection that data will be treated as semi-private data and must authorize their processing for the execution of commercial activities.

6.2. Sensitive data

MAMBO will restrict the processing of sensitive personal data to what is strictly necessary and will seek prior and express consent from the holders (legal representatives, proxies, assignees) informing about the exclusive purpose of their treatment.

MAMBO shall use and process sensitive data when:

Processing has been expressly authorized by the Data Controller, except in cases where the granting of such authorization is not required by law.
Processing is necessary to safeguard the vital interest of the holder and he is physically or legally disabled. In these events, the legal representatives must grant authorization.
Processing refers to data that is necessary for the recognition, exercise or defense of a right in a judicial process;
Treatment has a historical, statistical or scientific purpose or within the framework of improvement processes; the latter, provided that measures leading to the deletion of the Data Subjects’ identity are taken or that the data is de-linked, that is, the sensitive data is separated from the identity of the holder and is not identifiable or the Data Subject or sensitive data cannot be identified.

In addition to the above, EL MAMBO meets the following obligations:

Inform the holder that because it is sensitive data is not obliged to authorize its processing.
Inform the holder explicitly and in advance, in addition to the general requirements of the authorization for the collection of any personal data, Which data subject to processing is sensitive and the purpose of the processing, and obtain express consent.
Not to make any activity conditional on the holder providing sensitive personal data (unless there is a legal or contractual reason for doing so).

Likewise, MAMBO applies the general rule of processing sensitive data is prohibited by law, except in the following cases:

When the Data Controller has expressly authorized the Processing.
When the law does not require the exhaustion of such authorization.
When the Processing is necessary to safeguard the vital interest of the Holder.
When the Processing is carried out by a foundation, NGO, association or any non-profit organization whose purpose is political, philosophical, religious or trade union.
Processing is necessary for the recognition, exercise or defense of a right in a legal process.
The Processing is for historical, statistical or scientific purposes. In this case, the identities of the Holders must be deleted.

6.3. Processing of data relating to minors

For MAMBO, the data of children and adolescents collected, will be under the compliance of the Law and the data requested by the company will be expressly authorized by its representative or guardian, which is a person with employment relationship, the collected data are of a public information nature and the Human Resources area is responsible for their collection, processing and ensuring respect for children’s rights.

It is MAMBO’s obligation, through the data collector, to preserve respect for childrens’ rights. The Commission is also aware that the information provided by guardians and/or representatives must be kept in absolute reserve.

7. PURPOSE OF THE DATABASE

7.1. General purpose

MAMBO will collect through its different transactional channels the personal data of the holders to be used in: a) operations and registration activities; b) To attend or formalize any type of procedure, product or service that you request or require; c) Offer, inform, invite or pre-register the public for events and/or services d) carry out commercial activities; e) Transmit them to our strategic partners, affiliates, other areas of MAMBO.

In addition to the general purposes, there are particular purposes, taking into account the relationship that people have with EL MAMBO, as described below:

7.2. Security and control database – visitors

MAMBO, in order to protect the heritage of the Museum and the welfare of its collaborators, visitors, customers, creditors and others, establishes monitoring systems, surveillance and control through cameras located at strategic sites that monitor people, objects or processes for compliance with standards expected or desired in reliable on-site security systems.

The personal data and video surveillance images of our visitors are collected to facilitate the commercial operation of the visit, only the necessary data will be obtained, relevant and not excessive for:

Registration of entry of MAMBO
Verification and verification of the identity of the operators.
Control and preservation of the security of EL MAMBO people, assets and information.
Support to the sales processes of products and services of El MAMBO

7.3. Customer Database

Development of commercial proposals for sales of products or services offered by MAMBO to its customers.
Execution of supply contracts and/or provision of services concluded between MAMBO and its customers.
Offer and execution of services provided by MAMBO to its clients
To perform invoicing, collection and collection procedures for the value of services provided by MAMBO to its customers.
For administrative, commercial, advertising, legal, tax and regulatory purposes with the aim of contacting the owners thereof.
Consultation and reporting to the information and risk centers.
Support for the development of the Audits of the Museum process.
Management and follow-up of requests for improvement, requests and suggestions.

7.4. Database of suppliers

To carry out processes of choice, linking and selection of suppliers for the supply of goods and services required for the development of the social object of EL MAMBO
To carry out the accounting records of transactions for the purchase of goods and/or services.
Compliance with court decisions and administrative and legal, tax and regulatory provisions.
Support for the development of the Audits of the Museum process.
Any other use that the creditor authorizes in writing for the use of their information.
For the management of the process of payment of obligations through financial services and channels.

7.5. Donor database

Contact the donor holders to invite them to attend the different events that aim to promote and foster art and culture throughout the country.
Contact and select potential donors in money or kind who will support the different logistical resources of the museum through our annual fund or infrastructure fund.
Contact for sponsorship of events that support one or more curatorial, educational and development projects
When the user requests the issue of a donation certificate.
Make accounting records of the donation.
Verify that the donor is not associated with money laundering or terrorist financing.

7.6. Mambo network member database

Manage the activities related to the membership of the partner that contribute to the strengthening of the cultural mission and promoting the development of modern and contemporary art in Colombia; and Latin America.
Sending digital communications through website, email, applications, text messages, with the purpose of collecting greetings on special dates, satisfaction surveys, calls for events, exhibition activities agenda, access to private events and special programming, discounts on selected items from the EL MAMBO store and visits to our partner institutions.

7.7. Newsletter database

Send by e-mail to customers, interested parties and anyone who subscribes to the EL MAMBO newsletter monthly newsletter.
Make invitations to events, offer new products and services.

7.8. Artists’ database

Contact exhibitors and artists to schedule exhibitions and events for the culture of Bogotá and the country.
Manage donations of collections or works to the museum that will make you part of a vast collection of artists recognized worldwide.

7.9. Database of Board members, Board members and Benefactors

MAMBO will only use the personal data of Board members, Board members and Benefactors for purposes arising from the existing statutory relationship.

Creation and registration of members of the Directive Board, members of the Board of Directors and the Benefactors in the internal database.
Convocation to meetings of the general assembly or boards as appropriate.
Sending/receiving messages for the purpose of developing own activities as members of the Board of Directors, members of the Board of Directors and Benefactors
Any other purpose that results in the performance of the functions assigned to it by virtue of the relationship between the members of the Superior Council, Board members and Benefactors and the museum, under the Statutes of the museum.

7.10. Database of employees

In accordance with labour legislation, MAMBO will protect the data of employees and this arises in the duty to protect the information of employees so that they contribute to the safe management of personal information.

MAMBO shall only request, store and process the personal data obtained for:

The purposes relevant to the employment relationship (EPS, ARL, pension funds and severance, family compensation funds, etc.) including the transfer of my information to related third parties in the process.
In the case of judicial and legal requests requested by control bodies.
For accounting related to the process of settlement of payroll payment in all its concepts.
Process, confirm and comply with legal and non-legal labor obligations arising from the labor contract.
Support for the development of payroll and human management process audits.
Statistical analysis for payroll and social management behavior analyses.
Establish training and education programmes.
Transmit personal data and necessary with the banks, for the purpose of payment of their benefits.
Contact relatives, dependents and/or beneficiaries in case of emergency.
Participate in any other wellness, recreation and training programs.
The data on minors will only be used for recreational activities, training and other programmes developed to promote family welfare.

8. RIGHTS OF THE OWNERS

As the holder of your personal data you have the right to:

Access free of charge to the data provided that has been processed.
To know, update and rectify your information against partial, inaccurate, incomplete, fractional data that is misleading, or whose processing is prohibited or not authorized.
Request proof of the authorization granted.
To submit complaints for violations of the provisions of the current regulations to the Superintendence of Industry and Commerce (SIC).
Revoke the authorization and/or request the deletion of the data, provided that there is no legal or contractual obligation to delete them.
Refrain from answering questions about sensitive data. Replies concerning sensitive data or data on children and adolescents shall be optional.

9. REQUESTS, ENQUIRIES AND COMPLAINTS

For consultation, complaints, claims and complaints about the processing of personal data must be made by writing to the main address of the Museum Calle 24 No.6-00 or by e-mail info@mambogota.com, attaching a photocopy of the identity document of the Holder concerned or any other equivalent document that proves his identity and ownership legally.

10. PROCEDURE FOR THE EXERCISE OF HABEAS LAW

The Holders or their successors who consider that the information contained in MAMBO database should be corrected, updated or deleted, or who notice the alleged breach of any of the duties contained in Law 1581 of 2012, may file a complaint with MAMBO, through any of the communication channels described above, and shall contain the following information:

Identification of the data holder.
Precise description of the facts giving rise to the claim.
Notification data, physical and/or electronic address.
Any other documents you want to make.

If the claim is incomplete, the person concerned will be required to remedy the defects within five (5) days of receipt of the claim. After one (1) month from the date of the request, without the applicant submitting the required information, it will be considered that he has withdrawn the claim.

In the event that the person receiving the complaint is not competent to resolve it, he will send a message to the appropriate person within a maximum of two (2) working days and inform the person concerned of the situation.

Once the complete claim is received, a legend stating «claim in progress» and the reason for it shall be included in the database within no more than two (2) business days. This legend shall be kept until the claim is decided.

The claim will be answered within fifteen (15) working days, counting from the day following the date of its receipt. If it is not possible to meet the claim within the established deadline, MAMBO will inform the interested party of the reasons for the delay and the date on which their claim will be met, which shall not exceed eight (8) business days following the expiry of the first term.

Once the terms indicated by Law 1581 of 2012 and other rules that regulate or supplement it, the Holder who is refused, in whole or in part, the exercise of the rights of access, updating, rectification, deletion and revocation, may bring their case to the attention of the Superintendence of Industry and Commerce -Delegatura para la Protección de Datos Personales-.

11. VALIDITY

This Manual is valid from 1. September 2018. As a general rule, the term of the authorisations on the use of personal data is understood to be valid by the end of the business relationship or the link to the service and during the exercise of the company’s purpose.

Updates to the policy: MAMBO may modify the terms and conditions of this policy and procedures document as part of our effort to comply with the obligations set forth in Law 1581 of 2012, Regulatory orders and other rules supplementing, amending or repealing the contents of this document to reflect any changes in our operations or functions. In such cases, the new policy and procedures document will be published on www.mambogota.com.