Personal Data Processing Policy

AtomChat (hereinafter Atom) is a company that provides customer management services supported by technology tools and, in order to carry out those activities, processes personal data on a regular basis.

For that reason, and in order to comply with legislation on the processing of personal data, Atom presents its personal data processing policy to all interested parties.

1. What is the legal basis for this personal data processing policy?

Atom's personal data processing policy is based on:

Ley 1581 de 2021 of Colombia (Colombia's personal data protection statute).
The Political Constitution of Colombia
Decreto 1377 de 2013 of Colombia.
Sentencia C-748 de 2011 of Colombia (Constitutional Court ruling).
Decreto 1074 de 2015 of Colombia.
The international principles that apply to it, whether by legal provision or by its own choice, seeking higher levels of security and respect for the fundamental guarantees that have been adopted in other regions.

2. What is the purpose of this policy?

The purpose of this policy is to establish the general criteria for the collection, storage, use, circulation and erasure of the personal data collected by Atom, as well as to disclose any information that is relevant to the data subject before authorizing its processing.

3. Who is this policy binding on?

This policy is mandatory for all Atom staff and extends to all personal data collected by Atom.

4. Who is the Data Controller?

Atom Chat S.A.S, a commercial company legally incorporated in Medellín, Colombia, identified with tax ID (NIT) 9 0 1 4 2 0 2 6 9 -4, telephone 3145631623, email address for notices 90 48 E 14 AP 201 BRR FLORESTA tmarin@tomchat.io and with an address for notices at CR 90 48 E 14 AP 201 BRR FLORESTA in Medellín, Colombia, will act as the party responsible for the processing of the personal data collected at Atom Chat S.A.S. through all of its information-gathering channels.

Likewise, this Personal Data Processing Policy will apply to the processing of data of all companies associated with Atom Chat S.A.S., as part of the same corporate group, such as its subsidiaries, branches and parent company.

Atom may delegate part of the activities it carries out for the processing of personal data to a third party, who will be understood to be a Data Processor and who will assist it in complying with all its legal duties.

5. What are Atom's duties as Data Controller?

Atom recognizes that Personal Data belongs to its Data Subjects and that only they may decide about it. Taking into account the nature, scope, context and purposes of the processing, as well as the risks to individuals' rights and freedoms, Atom will apply appropriate technical and administrative measures in order to align its security and data processing measures with the applicable legal principles.

Accordingly, it assumes the following duties in its capacity as Data Controller:

To have a channel for obtaining express authorization from the Data Subject to carry out any type of data processing.
To request and retain, under the conditions provided by law, a copy of the corresponding authorization granted by the Data Subject.
To inform Data Subjects clearly and expressly of the Processing to which their data will be subjected and the Purpose of that Processing by virtue of the authorization granted.
To guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.
To supply the Data Processor, as applicable, only with data whose processing has been previously authorized in accordance with the Personal Data Act.
To inform all Data Subjects of the rights available to them regarding their data.
To maintain and safeguard the security of the Personal Data records stored, in order to prevent their deterioration, loss, alteration, or unauthorized or fraudulent use.
To carry out the updating and rectification of data periodically and promptly, whenever the Data Subjects report changes or make requests.
To provide the identification, physical and/or electronic address and telephone number of the person or area that will act as Data Controller.
To give timely notice of changes to this policy.

6. Definitions:

For the correct interpretation of this personal information processing policy, the following definitions are provided:

Authorization: prior, express and informed consent of the Data Subject to carry out the Processing of personal data;
Database: an organized set of personal data that is subject to Processing;
Personal data: any information linked to, or that may be associated with, one or more determined or determinable natural persons;
Data Processor: a natural or legal person, public or private, who by themselves or in association with others carries out the Processing of personal data on behalf of the Data Controller;
Data Controller: a natural or legal person, public or private, who by themselves or in association with others decides on the database and/or the Processing of the data;
Data Subject: a natural person whose personal data is subject to Processing;
Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation or erasure.
Privacy notice: a verbal or written communication generated by the Controller and addressed to the Data Subject for the Processing of their personal data, informing them of the existence of the information Processing policies that will apply to them, how to access those policies, and the purposes of the Processing intended for the personal data.
Public data: data that is not semi-private, private or sensitive. Public data includes, among others, data relating to a person's marital status, their profession or occupation, and their status as a merchant or public servant. By its nature, public data may be contained in, among others, public registries, public documents, official gazettes and bulletins, and duly enforceable court judgments that are not subject to confidentiality.
Sensitive data: sensitive data means data that affects the privacy of the Data Subject or whose improper use may give rise to discrimination against them, such as data revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social organizations or human rights organizations, or organizations that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sex life, and biometric data.
Transfer: a transfer of data takes place when the Data Controller and/or Data Processor of personal data, located in Colombia, sends the information or personal data to a recipient who is in turn a Data Controller and is located inside or outside the country.
Transmission: the processing of personal data involving its communication inside or outside the territory of the Republic of Colombia where the purpose is for Processing to be carried out by the Processor on behalf of the Controller.

7. Principles:

At any stage of information processing (collection, storage, use and circulation) Atom uses its best efforts to apply the following principles, which have been previously established by the regulations in force:

Principle of legality in the Processing of data: the Processing of data is a regulated activity that must comply with the provisions of the law
Principle of purpose: the Processing must serve a legitimate purpose in accordance with the Constitution and the Law, which must be communicated to the Data Subject;
Principle of freedom: Processing may only be carried out with the prior, express and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal or judicial mandate dispensing with consent;
Principle of accuracy or quality: the information subject to Processing must be truthful, complete, accurate, up to date, verifiable and comprehensible. The Processing of partial, incomplete, fragmented or misleading data is prohibited;
Principle of transparency: in the Processing, the right of the Data Subject to obtain from the Data Controller or the Data Processor, at any time and without restriction, information about the existence of data concerning them must be guaranteed;
Principle of restricted access and circulation: Processing is subject to the limits deriving from the nature of the personal data, from the provisions of this law and from the Constitution. Accordingly, Processing may only be carried out by persons authorized by the Data Subject and/or by the persons provided for in this law;
Personal data, other than public information, may not be available on the Internet or other means of mass disclosure or communication, unless access is technically controllable so as to provide restricted knowledge only to the data subjects or authorized third parties.
Principle of security: information subject to Processing by the Data Controller or Data Processor must be handled with the technical, human and administrative measures necessary to give security to the records, preventing their alteration, loss, or unauthorized or fraudulent consultation, use or access.
Principle of confidentiality: all persons involved in the Processing of personal data that is not public in nature are obliged to guarantee the confidentiality of the information, even after their relationship with any of the tasks comprising the Processing has ended, and may only supply or communicate personal data where this corresponds to the performance of activities authorized by law, or by following the procedures set out in the law.

7.1 Atom implements its data collection and processing in accordance with the legal regulations in force, and accordingly Atom:

Uses, for the handling of information, tools and integrations with third parties that comply with the data protection Act and with the GDPR where necessary, for specific purposes without any right to be shared or used for a purpose other than the one initially authorized by the user.
Complies with the general principles of the GDPR as regards data quality, consent and the right to information; and offers all data subjects the rights of access, rectification, data portability, restriction, erasure and objection, in addition to other recognized rights set out later in this document.

Complies with the general criteria of lawfulness, fairness and transparency in data processing. The purposes are specified, explicit and legitimate, and are communicated to the data subject in advance.

Applies data minimization, collecting only data that is adequate, relevant and limited to what is necessary.
Guarantees that such data is accurate and kept up to date, and retains it only for as long as necessary for the purposes of the processing.

Adopts appropriate technical and administrative measures to guarantee an adequate level of security.

8. Processing and purpose:

Atom collects personal data and uses it depending on the relationship it has with the data subject.

Accordingly, we wish to inform you of the following:

Data collection:

Atom will use different means for the collection of personal data, most of which are through digital channels such as contact forms, emails or chats. Atom collects personal data only through the following channels:

A.https://atomchat.io/

However, in order for Atom to collect personal data, the following procedure must be followed:

Atom will make this policy available to the general public so that data subjects have full knowledge of the processing to which the data will be subjected.
Data subjects must have complete clarity as to the person collecting their data, the use that will be made of their personal data, the rights available to them as data subjects, and how to exercise those rights
The data subject must then expressly accept this personal data processing policy by some means that allows Atom to be certain of the data subject's authorization and also to keep a copy of that consent. This authorization may be verbal or written, and digital tools may be used, provided they allow prior, express and informed consent to be obtained.

Atom collects only information that has been provided by the data subject after reviewing this policy. If the information is provided by a third party, that third party must be authorized to share it in accordance with the regulations in force.

Accordingly, Atom collects only private, semi-private or public information such as:

Name
Age
Level of education
Nationality
Occupation or trade
Personal telephone number
Email address
Address
Location data relating to the person's work activity.
Data relating to the person's employment history
Data on particular tastes and/or interests. E.g.: sports, leisure, food, tourism, fashion.
Date of birth
Marital status
Nationality
Academic history
Area of professional or educational interest
Work experience
Salary expectations
Current salary
Languages
Pension fund
Health system affiliation
Identity document
Information relating to the medium used to view the content offered by Atom, such as: type and version of operating system, technical characteristics and public IP address.
Browsing history across the content of Atom's websites.

In certain cases Atom will allow the collection of private or sensitive data relating to biometric identification or of a sensitive nature, such as:

Fingerprint
Voice
Videos - Images.

In certain cases this information is collected because the data subject is a member of Atom's staff and it is required for selection or security processes. The collection of this data will require express and specific authorization, and the information will be stored with stricter security controls.

Atom will not collect information relating to:

Medical history or health status. Unless authorized by legal provision and there is a reason for it.
Political, religious or philosophical orientation.
Racial or ethnic origin.
Data relating to the person's sexual orientation or sex life.
Membership of trade unions or political parties.
In general, sensitive data about individuals.

It is important to bear in mind that Atom is web software designed to perform automated tasks. Our bots allow our customers (those who have a subscription agreement for our service) to provide fast solutions to their own end customers, optimizing response times. Atom may therefore act in two ways with respect to the processing of personal data:

As Controller, when Atom directly collects personal data for its own commercial activity, to prospect and manage its own customers, as well as other activities necessary to carry out the company's remaining operations.
As Processor, when our customers use our technology solutions to manage their commercial activity. In these cases it is very important to bear in mind that the customer (who uses a subscription to Atom's service to perform automated tasks in their company) acts as the controller of the personal data of their end customers and must comply with all rules relating to the processing of personal data, and in particular must disclose their own personal data processing policies and implement appropriate procedures to obtain informed consent before beginning to process personal data.

As technology providers, we do not control the procedures, policies and activities that our customers carry out once they have collected data from their end customers. We do, however, have the ability to store certain copies of information that we use for our own purposes, as indicated below. Anyone who does not wish to be subject to processing by Atom may send their request, complaint or claim to the channels authorized in this document.

Our customers (those who hold the subscription agreement with Atom) are responsible for correcting, deleting or updating the information they process through the subscription service purchased, and must obtain the corresponding consent before storing and/or transferring data to Atom's servers.

It is important to bear in mind that, in the Subscription Agreement, the Atom customer grants a special power for Atom to carry out a data anonymization process and to download and use as it sees fit certain information of interest to it. Atom will thereby take information from the databases created by the customer, omitting all sensitive information or information that in any way allows a person to be individually identified, such as name, identification number, address and telephone numbers, and retaining information that is not capable of identifying a natural person, in order to parameterize information and produce statistical reports. It is the customer's obligation to inform data subjects of this condition before entering the information into Atom's system. If consent is not obtained, the customer must inform Atom.

Storage and use:

Once the data has been received by Atom, in accordance with the provisions of this Policy, it will be stored by Atom in its digital facilities with acceptable security measures, to be used for the following activities:

A. Where the personal data of a staff member is concerned:

Classification within the information systems as contractor, employee or candidate.
Verification of all information recorded in the résumé or service proposal. This includes communication with the third parties that the candidate has included as references in their résumé or in the document with which they wish to join Atom, in accordance with the authorization given for that purpose by the data subject.
Communication with the candidate for activities such as psychometric tests, knowledge tests and assessment activities in order to verify the candidate's level of knowledge.
Professional profiling in line with the roles available at Atom.
Feedback on the services provided.
Hiring.
Enrollment in the social security system.
Payroll and social security payments.
Management of sick leave.
Development of corporate wellbeing plans
Productivity reports.
Notification of disciplinary proceedings.
Communication by telephone or instant messaging to provide urgent information affecting the normal operation of Atom.
Sending corporate communications by email.
Issuing certificates at the data subject's request
Implementation of occupational health and safety programs or their equivalent.
Management of requests, complaints and claims (PQR)
Studies carried out by the recruitment and human resources areas to verify staff satisfaction levels, candidates' education levels, and motivational factors at work.
Issuing of ID badges for entry to Atom's physical premises, assignment of usernames and passwords, corporate email, and segmentation by professional or organizational profile.
Offering and planning company activities for the data subject and their beneficiaries (children, spouse, domestic partner).
Transmitting personal data outside the country to third parties with whom Atom has entered into a data processing agreement and where it is necessary to provide it in order to fulfill the purpose of the contract.

In order to carry out those activities, the personal data will be stored, classified, viewed and used by Atom personnel. Such personnel receive ongoing training on the processing of personal data and are also subject to confidentiality obligations regarding the information.

Those activities have the purpose of:

Creating and maintaining Atom's workforce

Complying with Atom's obligations as Employer or contracting party.

Managing Atom's human talent.

Implementing security processes for access to Atom's premises,

Implementing workplace wellbeing processes.

B. Where individuals who intend to use Atom's services or who are connected with Atom's commercial activity are concerned, as regards the use of an Atom subscription:

Handling requests, complaints or claims.
Carrying out billing and collection activities.
Sending information of interest regarding the subscription purchased.
Optimizing Atom's subscription services (Atom may analyze its customers' behavior on the platform and use that information to optimize its services).
Generating projects and presenting service proposals.

Those activities have the purpose of fulfilling Atom's service promise and managing its customers' payments.

Likewise, the processing of this data also has the purpose of:

Promoting the products and services offered by Atom

Identifying and prospecting potential customers.

Participating in studies and research to develop products and services.

With respect to the personal data of third parties that enters Atom's information systems on behalf of customers, a data anonymization process will be carried out; if a Customer becomes aware that a data subject does not wish this process to be carried out, they may notifyinfo@atomchat.io

C. Circulation:

The personal data collected by Atom circulates internally within the company in order to carry out Atom's corporate purpose and to enable the company's administrative and commercial operation, as well as the provision of its services.

Externally, it circulates with:

The electronic invoicing technology provider where necessary.
Social security system entities where necessary.
Third-party operators of digital platforms integrated with the Atom Subscription. Atom is able to provide its services in collaboration with third-party platforms, which manage information in accordance with their own policies; we invite all interested parties to review them.

D. Erasure of data:

As a general rule, the data stored at Atom is kept for the term of validity of the databases, after which it is deleted from those databases.

9. Rights of data subjects:

As the subject of your personal data, you have the right to:

Access free of charge the data you have provided that has been subject to processing.
Know, update and rectify your information where data is partial, inaccurate, incomplete, fragmented or misleading, or where its processing is prohibited or has not been authorized.
Request proof of the authorization granted.
File complaints with the competent authorities for breaches of the provisions of the regulations in force.
Revoke the authorization and/or request the erasure of the data, provided there is no legal or contractual duty preventing its deletion.
Refrain from answering questions about sensitive data. Answers relating to sensitive data, or to data concerning children and adolescents, are optional.

The following rights will likewise be taken into account:

Right to object: under the right to object, where the data subject expresses to the controller their refusal to have their personal data processed, the controller will stop processing it provided there is no legal obligation preventing this.
Right to portability: under the right to portability, data subjects may request to receive a copy of their personal data in a structured, commonly used and machine-readable format. They also have the right to request that it be transmitted directly to a new controller, whose identity must be communicated, where technically possible.

The rights of data subjects may be exercised by the following persons:

By the data subject, who must sufficiently prove their identity by various means, such as providing at least two identity documents showing their full name and identification number, if considered necessary.
By their successors in title, who must prove that status;
By the data subject's representative and/or attorney-in-fact, upon proof of representation or power of attorney;

The rights of children and adolescents will be exercised by the persons authorized to represent them.

10. Area responsible for handling requests, inquiries and claims

The Customer Care Lead is the department responsible for processing data subjects' requests to give effect to their rights.

11. Procedure:

In compliance with the legislation in force, Atom sets out the procedure for exercising Habeas data:

In order for your request to be handled, please provide the following information to the email address info@atomchat.io

Full name and surnames
Contact details (physical and/or electronic address and contact telephone numbers), means for receiving a reply to your request
Reason(s)/fact(s) giving rise to the claim, with a brief description of the right you wish to exercise (to know, update, rectify, request proof of the authorization granted, revoke it, erase, or access the information)
Signature
Identification number
Your relationship with Atom.

The maximum period established by Atom for resolving a claim is 10 business days, counted from the day following the date of its receipt. Where it is not possible to address the claim within that period, Atom will inform the interested party of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight (8) business days following the expiry of the first period. Once the stated periods have elapsed, a data subject who is denied, in whole or in part, the exercise of the rights of access, updating, rectification, erasure and revocation may bring their case to the attention of the competent authorities (if the data subject is Colombian or the applicable law is Colombian legislation, they may turn to the Superintendencia de Industria y Comercio, Colombia's industry and commerce regulator)

12. Term:

This Personal Data Processing Policy is in force as from December 2022. The databases in which personal data is recorded will remain valid for as long as the information is kept and used for the purposes described in this policy. Once those purposes have been fulfilled, the data will be retained for up to 3 further years, in order to study the behavior of the data subject where they are a customer or a user of Atom's services. Where they are an employee, the information will be retained for archival purposes.

This Policy may be amended at any time; however, in all cases notice will be given to the data subjects whose data has been collected under this policy, so that they may state whether they accept or reject the new version.

It is important to mention that Atom implements different tools on its digital platforms to study its users' behavior on the internet. In this regard, Atom advises that when a person accesses its platforms, elements are installed that are capable of collecting information about individuals; that information relates to:

IP address
Time zone settings
Information about the device used to view emails
Content visited within the websites managed by Atom.

If the user allows the tracking and operation of the Cookies that are installed, their browsing patterns may be tracked and targeted advertising may be sent to them.

If a user does not wish to share this type of information, they may restrict the use of cookies and also delete them if they allowed them at any point, following the procedure chosen by their own web browser.

Not all the tools implemented on the digital platforms are for tracking and analytics purposes; some are necessary for the optimization of the platform, and so rejecting them may cause the page to malfunction.