Transparency is everyone's responsibility. We invite you to learn about our Data Policy and Treatment.

POLICY ON THE PROCESSING OF PERSONAL DATA OF HIERBAS Y PLANTAS TROPICALES S.A.S. – HIPLANTRO

I.          Objective and Scope

This policy regulates the processing of personal data of allies, employees, contractors, subcontractors, suppliers, users, clients, consumers, and any person whose personal data is or will be processed (hereinafter referred to as the Holders) by the company HIERBAS Y PLANTAS TROPICALES S.A.S. (hereinafter HIPLANTRO), identified with the NIT 811.012.366-4, located in Envigado, Antioquia, as the Responsible Party and/or Person in Charge of the processing, and its purpose is to guarantee the rights of the Holders, inform about the mechanisms and procedures to enforce those rights, address questions, complaints, and claims, and disclose the processing to which all personal information (hereinafter referred to as Personal Data) will be subjected within the commercial activity and its purpose, in accordance with the current regulations in Colombia.

II.          Authorization

HIPLANTRO, its employees, and authorized third parties must obtain prior consent before collecting Personal Data, which may be consulted or verified by the Holder or any competent authority in the matter.

For that, HIPLANTRO makes available to the Holders the authorization for the processing of their personal data in the various scenarios in which it collects such data, both physically and digitally, through an authorization form. This form informs the Holder about the processing to which their Personal Data will be subjected, including the purposes, their rights, the channels for exercising their rights, and the related information about the Personal Data Protection Policy.

III.          TREATMENT

To comply with Law 1581 of 2012, Decree 1377 of 2013, and other regulations that govern or complement them, HIPLANTRO, in the course of its commercial activities, will collect, use, manage, store, analyze, anonymize, index, segment, profile, compile, process, transmit, transfer, verify personal data, carry out collections, and share information with risk centers if necessary, and will perform various operations with personal data. In this regard, the personal data processed by HIPLANTRO will be subject only to the purposes outlined below or those authorized by the Data Subjects at the time of data collection.

IV.          PURPOSES

HIPLANTRO and those who, with prior authorization from the Data Subject, have access to the Personal Data by law, contract, or other binding documents, will carry out the Processing for the following purposes: (i) To offer loyalty programs for the end consumer, promotions, and discounts; (ii) To inform about the existence of new products and services, both proprietary and third-party; (iii) To track the behavior of the Data Subjects, mobile phones, and their consumption preferences; (iv) To create profiles of the Data Subjects and users of platforms or websites owned by HIPLANTRO., a Based on their consumption preferences and behavior on the internet and mobile phones; (v) To send information about news, updates, and promotions of both proprietary and third-party products; (vi) To send information about CRM programs, both proprietary and third-party; (vii) To specify, analyze, and optimize existing and future products and services, both proprietary and third-party; (viii) To export information regarding human resources, credit risks, and the control and prevention of money laundering; (ix) To build segmented databases; (x) To carry out activities of archiving, updating, storing, and processing information, either independently or through third parties contracted for this purpose; (xi) To promote and market new and existing products and services, both proprietary and third-party; (xii) To track, measure, and record the spending and consumption capacity of the Data Subjects; (xiii) To index information and Personal Data based on the behavior of the Data Subjects and their consumption preferences; (xiv) Geo-location; (xv) To conduct statistical analysis of the collected data to optimize the performance of the provided service; (xvi) To ensure the effectiveness and security of transactions carried out through any electronic platform or website; (xvii) To personalize the website and/or mobile applications according to the tastes and interests of the end user; (xviii) To fully comply with contracts or transactions entered into with customers and users, in accordance with their purposes to offer HIPLANTRO products and/or services; (xix) To complement the information and, in general, to carry out the necessary activities to manage requests, complaints, and claims made by users and third parties, directing them to the responsible areas for issuing the corresponding responses; (xx) To send information and commercial offers for HIPLANTRO products, as well as to carry out marketing and/or commercialization activities for products and/or services that it provides or may provide or offer; (xxi) To conduct market studies, statistics, surveys, market trend analysis, and satisfaction surveys regarding the products manufactured, marketed, sold, and distributed; (xxii) To transmit personal data to third parties with whom contracts have been established for the purpose of carrying out and fulfilling the product and/or service offered through HIPLANTRO for commercial, administrative, and/or operational purposes; (xxiii) To manage all information necessary to fulfill tax obligations and commercial, corporate, and accounting records; (xxiv) To identify users when they access their websites; (xxv) To proceed with the invoicing and collection of the product and/or service; (xxvi) To share Personal Data with service companies oroutsourcing"that contribute to improving or facilitating operations through HIPLANTRO, including payment methods, insurance or payment management intermediaries, transportation and messaging companies, advertising agencies, department store chains, hard discount retailers, or large retail chains; (xxvii) to transmit or transfer data to third parties, whether legal entities or individuals."

HIPLANTRO will ensure that the policies of third parties that access or process Personal Data have standards similar to those of this Policy, through the signing of agreements, contracts, and/or arrangements.

The Holder expressly acknowledges that the commercial information collected will be used for commercial purposes, which includes sending commercial, promotional, and advertising information related to the products and/or services that HIPLANTRO offers. offers, which may be exercised through (i) emails, (ii) text messages (SMS), via WhatsApp or Telegram, and/or (iii) phone calls (mobile or landline).

V.          RIGHTS OF THE HOLDER

The Holder, in accordance with the provisions of Law 1581 of 2012 and Decree 1377 of 2013, has the following rights:

(i)               Know, update, and rectify your personal data.

(ii)             Request proof of the authorization granted.

(iii)            Be informed about the uses or treatment granted to the Holder's Personal Data, upon prior request by the Holder.

(iv)           Submit complaints to the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012, Decree 1377 of 2013, and other legal provisions on the matter, once the procedure for direct consultation or complaint has been exhausted

(v)            Revoke the authorization and/or request the deletion of the data when the treatment does not respect the constitutional and legal principles, rights, and guarantees;

(vi)           Access for free to your personal data that has been subject to treatment.

Holders may exercise their legal rights and follow the procedures established in this Policy by presenting their citizenship card or any identification document. Minors may exercise their rights through their parents or adults who hold parental authority, who must demonstrate this with the relevant documentation. Additionally, all authorized individuals may exercise the rights of the Holder by presenting the appropriate document.

VI.          CONTENT OF THE INFORMATION

To carry out its commercial activities and ensure the proper marketing of its products and the provision of services offered, HIPLANTRO will collect the following information:

–        Personal identification information, including but not limited to: first and last names, ID number or identification, age, phone number, address, and other types of information that allow identification of users.

–        Personal information to contract services or purchase products, namely: (i) First and last names; (ii) ID number or identification; (iii) Address; (iv) Email address; (v) Date of birth; (vi) Phone number; (vii) Payment method information; (viii) Professional information, degrees, and references both personal and professional; (ix) Any other information required for the provision of services and the purchase of the offered products. 

The products and services offered by HIPLANTRO are aimed at adults. Therefore, the minors should refrain from providing personal information to be included in our database. 

VII.          sensitive data

In the exercise of its commercial purpose, HIPLANTRO may collect and process Sensitive Data, such as, but not limited to: (i) Images, photographs, and/or voice recordings; (ii) information related to political, religious, or philosophical affiliation; (iii) information related to health, gender, and, in general, (iv) any information whose processing may involve discrimination against the Holders.

In such cases, Holders will be informed so they can provide independent and voluntary consent for the processing of such Sensitive Data, which will be handled with the highest security standards.

HIPLANTRO will not process sensitive data of minors, as defined by Law 1581 of 2012, which refers to data that affects the privacy of the Holder and whose improper use may lead to discrimination. This includes data that reveals union affiliations, racial or ethnic origin, political orientation, religious, moral, or philosophical beliefs, membership in trade unions, or social organizations for human rights that promote the interests of any political party or guarantee the rights and guarantees of political parties or positions.

VIII.          Procedures

In order for the Data Subject to exercise their rights, the existing procedures applicable to the processing of their Personal Data are outlined below.

These rights can only be exercised by the Data Subject, their heirs, or representatives, upon verification of their identity. To facilitate this, HIPLANTRO provides the Data Subject with the form titled 'Complaints, Claims, and/or Requests Form - Personal Data Processing' on its website www.lateresita.co and specifies the documents that must be attached to it.

To address any questions, inquiries, complaints, queries, or requests for any information related to their personal data, particularly to exercise their rights to know, update, rectify, and delete data or revoke the given authorization, the Data Subject must contact HIPLANTRO via an email directed to: [email protected]

a.     Inquiries

According to Article 14 of Law 1581 of 2012, holders or their beneficiaries may consult the personal information of the holder that resides in any database. Consequently, HIPLANTRO has mechanisms in place for information holders, directly or through their representatives, beneficiaries, or proxies, to exercise their right to consultation, providing them with all the information contained in the individual record or linked to the identification of the holder.

Consultation requests will be addressed within a maximum term of ten (10) business days from the date of receipt. If it is not possible to address the consultation within this period, the interested party will be informed before the ten (10) days expire, stating the reasons for the delay and indicating the date by which their consultation will be addressed, which in no case may exceed five (5) business days following the expiration of the initial deadline.

b.     Complaints

In accordance with the provisions of Article 14 of Law 1581 of 2012, the data subject, their beneficiaries, or representatives who believe that the information contained in a database should be corrected, updated, or deleted, or who identify a potential breach of any obligations outlined in Law 1581 of 2012 and the regulations that govern or complement it, or who wish to revoke the authorization granted for the treatment of personal data, may submit a complaint to HIPLANTRO, which will be processed under the following rules:

The complaint must be submitted by the data subject, their beneficiaries, or their representative, in accordance with Article 15 of Law 1581 of 2012, using the forms provided by HIPLANTRO for this purpose. If the received complaint lacks the complete information necessary for processing, meaning it does not include the identification of the data subject, a description of the facts giving rise to the complaint, the address, and any supporting documents to be considered, the interested party will be requested to correct these deficiencies within five (5) days following receipt. If two (2) months pass from the date of this request without the applicant providing the required information, it will be understood that they have withdrawn the complaint.

If the person receiving the complaint is not competent to resolve it, they will refer it to the appropriate authority within a maximum period of two (2) business days and will inform the interested party of the situation.

Once the complete complaint is received, a note stating "claim in process" along with the reason for the complaint will be included in the database maintained by HIPLANTRO within a period not exceeding two (2) business days. This note must be maintained until the complaint is resolved.

The maximum term to address the complaint will be fifteen (15) business days counted from the day after its receipt. When it is not possible to address it within this term, the interested party will be informed before the expiration of the specified period of the reasons for the delay and the date on which their complaint will be addressed, which may not exceed eight (8) business days following the expiration of the initial term.

For all purposes, the request for data deletion and the revocation of the authorization for data processing will be processed as a complaint, and the terms specified in Article 15 of Law 1581 of 2012, as outlined in the previous subsection b of this Policy, will apply to them.

–        Deletion

The Holder has the right, at any time, to request HIPLANTRO to delete (eliminate) their Personal Data when they believe that such data is not being processed in accordance with the principles, duties, and obligations set forth in Law 1581 of 2012; when it is no longer necessary or relevant for the purpose for which it was collected; or when the necessary period for fulfilling the purposes for which it was collected has been exceeded.

This deletion implies the total or partial removal of the personal information according to what the holder requests from the records, files, databases, or processing carried out by HIPLANTRO. However, the company may deny the exercise of this right when the Holder has a legal or contractual obligation to remain in the database; when the deletion of data hinders judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes, or the updating of administrative sanctions; or when the data is necessary to protect the legally protected interests of the Holder, to perform an action in the public interest, or to comply with a legally acquired obligation by the Holder.

–        Revocation of Authorization

Holders of Personal Data can revoke their consent for the processing of their Personal Data at any time, as long as no legal provision prevents it. To facilitate this process, HIPLANTRO will establish simple and free mechanisms that allow the Holder to revoke their consent, at least through the same means by which it was initially granted. This ensures that Holders have the ability to manage their data and maintain control over how it is used.

There are two modalities through which the revocation of consent can occur. The first modality involves revoking consent for all consented purposes, meaning that HIPLANTRO must completely cease processing the Holder's data. The second modality allows for the revocation of consent for specific types of processing, such as for advertising purposes or market research. With the second modality—partial revocation of consent—other purposes of processing that HIPLANTRO may carry out, in accordance with the authorization granted and which the Holder agrees to, remain unaffected. This ensures that the Holder can maintain control over specific aspects of their data while allowing HIPLANTRO to continue processing data for other agreed-upon purposes.

Therefore, it will be necessary for the Holder, when submitting the request for revocation of consent to HIPLANTRO, to specify whether the intended revocation is total or partial. In the second scenario, the Holder must indicate which specific processing the Holder does not agree with.

There will be cases where consent, due to its necessary nature in the relationship between the Holder and HIPLANTRO, either for the fulfillment of a contract or by legal provision, cannot be revoked at the time of the request. However, it may be revoked later when the impediment is removed, which HIPLANTRO must indicate in its response to the request.

   IX.          TRANSFER OF AND TRANSMISSION OF DATA

The data subject expressly authorizes HIPLANTRO to transfer and/or transmit their personal data to third parties (business partners, suppliers, clients, contractors) who, as data controllers and/or processors, may handle the personal data to carry out the necessary management required for HIPLANTRO to provide high-quality products and/or services to the data subject. 

In any case, the third party receiving the personal data transferred or transmitted by HIPLANTRO will be obligated to comply with this Data Treatment Policy and the strict scope of the authorization previously granted by the data subject for their respective processing.

X.          Transformations, Dissolution, Liquidation, Split, or Merger

The holder expressly authorizes HIPLANTRO to share their Personal Data, including Sensitive Data, with legal entities other than HIPLANTRO that may arise as a consequence of the dissolution, merger, split, or liquidation of HIPLANTRO. Thus, in the event that HIPLANTRO undergoes transformations, whether by establishing a new legal entity, regardless of its corporate type, or by transferring all its assets to an already constituted legal entity, all Personal Data, including Sensitive Data, will be transferred or transmitted in accordance with the provisions of this Data Protection Policy.

XI.          SECURITY

In accordance with the security principle established in Law 1581 of 2012, HIPLANTRO will adopt the necessary technical, technological, human, and administrative measures to ensure the security of the records and files containing Personal Data, preventing their alteration, loss, consultation, unauthorized use, or fraudulent access.

HIPLANTRO will maintain mandatory security protocols for personnel with access to personal data and the information systems or storage thereof.

XII.          CONTACT

To address any concerns, inquiries, complaints, claims, or requests for any type of information related to their Personal Data, particularly to exercise their rights as the Holder of the Personal Data provided to HIPLANTRO, the Holder may contact the Customer Service area by sending an email to [email protected].

XIII.          MODIFICATIONS

HIPLANTRO reserves the right to modify this policy at any time and without prior notice. Any modifications will take effect and be enforceable against related third parties from the date of its publication through the appropriate channel.

XIV.          VALIDITY

The current data policy comes into effect as of the day November 1, 2021.

The Personal Data that is stored, used, or transmitted will remain in HIPLANTRO's database for as long as necessary for the purposes mentioned in this Policy, for which they were collected. Thus, the validity of the database is closely related to the purposes for which the personal data was collected.

Authorization for the Processing of Personal Data 

Authorizes HIERBAS Y PLANTAS TROPICALES S.A.S. – HIPLANTRO S.A.S., a commercially registered company, identified by the NIT 811.012.366-4 (hereinafter referred to as The Responsible Party), to process your personal data as the Responsible Party and, therefore, may collect, store, manage, use, process, analyze, transfer, transmit, protect, and delete, through any physical or digital interaction, your personal data (name, ID number or identity document, age, gender, phone number, email, and address), as well as data related to consumption preferences, visits, and internet behavior, financial information, or other data that may be relevant for the commercial operation of the Responsible Party. for the following purposes:

 (i) To offer loyalty programs for end consumers, promotions, and discounts; (ii) To inform about the existence of new products and services, both proprietary and third-party; (iii) To track the behavior of the holders, mobile phones, and their consumption preferences; (iv) To create profiles of the holders, users of the platforms or websites owned by the Responsible party., a (v) To send information about news, updates, and promotions related to the Responsible party and third parties; (vi) To send information regarding CRM programs, both proprietary and third-party; (vii) To specify, analyze, and optimize existing and future products and services, both proprietary and third-party; (viii) To export information regarding human resources, credit risks, and the control and prevention of money laundering; (ix) To create segmented databases; (x) To carry out activities related to archiving, updating, storing, and processing information, either independently or through third parties contracted for this purpose; (xi) To promote and market new and existing products and services, both proprietary and third-party; (xii) To track, measure, and record the spending capacity and consumption patterns of the holders; (xiii) To index information and personal data based on the behavior and consumption preferences of the holders; (xiv) To carry out geo-location activities; (xv) To perform statistical analysis of the collected data to optimize the functionality of the services provided; (xvi) To ensure the effectiveness and security of transactions conducted through any electronic platform or the website of the Responsible party. Responsable(xvii) To personalize the website and/or mobile applications according to the tastes and interests of the end user; (xviii) To fully comply with contracts or transactions made with customers and users, according to the purposes of providing the products and/or services of the Responsible party. Responsable(xix) To complement the information and, in general, carry out the necessary activities to manage requests, complaints, and claims made by users and third parties, and direct them to the areas responsible for issuing the corresponding responses; (xx) To send information and commercial offers for the products of the Responsible party. Responsable, as well as to carry out marketing and/or commercialization activities for products and/or services provided or that may be provided or offered; (xxi) To prepare market studies, statistics, surveys, market trend analyses, and satisfaction surveys regarding the products manufactured, marketed, sold, and distributed; (xxii) For the transmission of personal data to third parties with whom contracts have been established for the purpose of executing and fulfilling the product and/or service offered through the responsable ones , for commercial, administrative, and/or operational purposes; (xxiii) To manage all the necessary information to comply with tax obligations and commercial, corporate, and accounting records; (xxiv) To identify users when they access their Websites; (xxv) To proceed with the invoicing and collection of the product and/or service; (xxvi) To share Personal Data with service companies or companies ofoutsourcingthat contribute to improving or facilitating operations through the Responsible Party, including payment methods, insurance or payment management intermediaries, transportation and messaging companies, advertising agencies, department store chains, hard discount retailers, or large retail chains; (xxvii) to transmit or transfer data to third parties, whether legal entities or individuals."

He recognizes that as the holder of his personal data, he has all the rights established in the Constitution and in Law 1581 of 2012 and the other regulations that amend or complement it, especially the following:

a) To access, free of charge, the provided data that has been subject to processing.

b) Request the updating and rectification of information regarding partial, inaccurate, incomplete, fragmented, misleading data, or those whose processing is prohibited or has not been authorized.

c) Request proof of the authorization granted.

d) Submit complaints to the Superintendence of Industry and Commerce (SIC) for violations of the provisions of current regulations.

e) Revoke the authorization and/or request the deletion of the data, unless there is a legal or contractual duty that makes it imperative to retain the information.

f) Refrain from answering questions about sensitive data.

These rights may be exercised through the channels or means provided by the Controller for customer service, as follows:

Through the national hotline 3187114631; the email [email protected] and in the customer service offices nationwide located at Carrera 56 a # 72 a 101, Itagüí Antioquia, whose information can be consulted at www.xxxxxx.co, available from Monday to Friday from 8:00 a.m. to 6:00 p.m., to attend to requirements related to the processing of your personal data and the exercise of the rights mentioned in this authorization.

For all of the above, you have given your consent to the Controller to process your personal information in accordance with the Personal Data Processing Policy established by it, which can be consulted at lateresita.co.

You declare that this authorization was requested and presented to you before providing your data and that you subscribe to it freely and voluntarily once read in its entirety.