Data privacy policy

Last updated: Nov 4, 2026

Goal

Law 1581 of 2012, "By which general provisions are issued for the protection of personal data,” develops the constitutional right of all people to know, update, and rectify the information about them in databases or files. It also develops the other rights, freedoms, and constitutional guarantees of article 15 of the Political Constitution. It also develops the right to information of article 20 of the same Constitution.

FLUIDSIGNAL GROUP S.A.S. certifies the protection of rights such as Habeas Data, privacy, intimacy, good name, image, and autonomy. For this purpose, the principles of good faith, legality, computer self-determination, freedom, and transparency govern all its actions.

FLUIDSIGNAL GROUP S.A.S. always keeps in mind that the personal data are the property of the people to whom they refer. Only these people can decide about them.

FLUIDSIGNAL GROUP S.A.S. guarantees the right of access. After the owner proves their identity, FLUIDSIGNAL GROUP S.A.S. makes the personal data available to the owner free of charge. This access must have no limit, and it must let the owner know and update their data.

Guiding principles of the personal data processing policy

These specific principles apply to the processing of personal data:

Principle of legality: The current provisions for the processing of personal data and other fundamental rights apply.
Security principle: Personal data must be protected as much as technical resources allow, against adulteration, loss, consultation, and, in general, all unauthorized use.
Principle of confidentiality: Some people administer, manage, or have access to information in databases. These people must keep all the personal information that they receive during their duties strictly confidential. The people who work, or are linked, now or in the future, in the administration and management of databases must sign an agreement to confirm this commitment. This agreement is added to their employment or service contract. This obligation continues after their relationship with any of the processing tasks ends.
Principle of freedom: Data processing can only occur with the prior, express, and informed consent of the owner. No one can get or disclose personal data without prior authorization, or without a legal, statutory, or judicial mandate.
Principle of truthfulness: The information must be true, complete, accurate, up-to-date, verifiable, and understandable.
Principle of transparency: The processing of personal data must guarantee the right of the owner to get information about the existence of any type of information or data about them that is of interest to them.
Purpose principle: Data processing must have a legitimate purpose, and the owner of the personal data must be informed of this purpose.
Principle of restricted access and circulation: Personal data, except public information, cannot be available on the Internet or other means of mass dissemination, unless access is technically controllable.

The data protection principles apply to all databases, including the databases that this article excepts, with the limits of this law. They must apply without conflict with the data that the legal reserve covers. The special regulations of the excepted databases can have principles for the special nature of the data. In this case, these principles apply together with the principles of this law.

Definitions

Authorization: Prior, express, and informed consent of the owner to the processing of personal data.
Database: Organized set of personal data that is subject to processing.
Personal data: Any information that is linked, or that can be linked, to one or more specific or determinable natural persons.
Sensitive data: Data that affect the privacy of the owner. Examples are the racial or ethnic origin, the political orientation, the religious or philosophical convictions, and the membership in unions, social organizations, or human rights organizations. Other examples are the data about health and sexual life, and the biometric data.
Data processor: Natural or legal person who processes personal data for the data controller.
National Registry of Databases (RNBD): The public directory of the databases that are subject to processing and operate in the country. The Superintendence of Industry and Commerce administers it, and users and citizens can consult it freely.
Data controller: Natural or legal person who makes decisions about the database and/or the processing of data.
Owner: Natural person whose personal data are processed.
Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.

Scope of application

Some natural or legal persons, public or private, process databases with personal data automatically or manually, in Colombian territory or outside it. These databases must be in the National Registry of Databases. For data processing outside Colombian territory, this applies only if Colombian legislation applies to the data controller or data processor because of international standards and treaties. This does not affect the exceptions of Article 2 of Law 1581 of 2012.

Exception to the regulatory framework

The personal data protection regime of this law does not apply to these databases and files:

Databases or files in an exclusively personal or domestic environment. Before anyone gives these databases or files to third parties, that person must tell the owner and ask for the authorization of the owner. In this case, the data controllers and data processors of the databases and files are subject to the provisions of this law.
Databases and files whose purpose is national security and defense, and the prevention, detection, monitoring, and control of money laundering and the financing of terrorism.
Databases whose purpose is intelligence and counterintelligence information, and that contain this information.
Databases and archives of journalistic information and other editorial content.
The databases and files that Law 1266 of 2008 regulates.
The databases and files that Law 79 of 1993 regulates.

The data controller and data processor for personal data processing

Name: FLUIDSIGNAL GROUP S.A.S.

Address: Street 43 No. 9 South - 195 Office 736 Square Building, Medellín

Email: [email protected]

Phone: (604) - 4442637

Enrollment in the National Database Registry

FLUIDSIGNAL GROUP S.A.S. must register in the National Registry of Databases each database with personal data that is subject to processing, independently.

Duties of data controllers

The data controllers must comply with these duties. This does not affect the other provisions of this law and of the other laws that govern their activity:

Guarantee to the owner, at all times, the full and effective exercise of the right of habeas data.
Request and keep, under the conditions of this law, a copy of the authorization that the owner gave.
Correctly inform the owner about the purpose of the collection and about the rights that the owner has because of the authorization.
Keep the information under the necessary security conditions to prevent its adulteration, loss, or unauthorized or fraudulent consultation, use, or access.
Guarantee that the information given to the data processor is true, complete, accurate, updated, verifiable, and understandable.
Update the information. Tell the data processor, in a timely manner, all the changes to the data that the data controller gave before. Also, take the other necessary measures to keep the information updated.
Rectify the information when it is incorrect, and send the applicable information to the data processor.
Give the data processor, as applicable, only data whose processing is authorized before, in accordance with the provisions of this law.
Demand that the data processor always respects the security and privacy conditions of the information of the owner.
Process queries and claims in the terms of this law.
Adopt an internal manual of policies and procedures to guarantee correct compliance with this law and, especially, to answer queries and complaints.
Tell the data processor when the owner disputes some information, after the owner submits the claim and while the procedure is not complete.
Inform the owner, when the owner asks, about the use of their data.
Inform the data protection authority when violations of security codes occur and there are risks in the administration of the information of the owners.
Comply with the instructions and requirements of the Superintendency of Industry and Commerce.

Collection of personal data

In accordance with the principles of purpose and freedom, the collection must include only the personal data that are relevant and appropriate to the purpose of the collection or requirement. This must be in accordance with current regulations. Except in the cases that the law expressly allows, no one can collect personal data without the authorization of the owner.

If the Superintendence of Industry and Commerce asks for it, the controllers must describe the procedures for the collection, storage, use, circulation, and deletion of information. They must also describe the purposes of the information collection and explain why it is necessary to collect data in each case.

Deletion of personal data

The owner has the right, at all times, to ask FLUIDSIGNAL GROUP S.A.S to delete their personal data when they decide to do so. This deletion is the total or partial elimination of personal information, as the owner requests. The right of cancellation is not absolute. The person responsible can deny it in these cases:

The owner has a legal or contractual duty to stay in the database.
The deletion of data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes, or the update of administrative sanctions.
The data are necessary to protect the legally protected interests of the owner, to do an action based on the public interest, or to comply with an obligation that the owner legally acquired.

Processing and purpose of personal data

These are the purposes of the general processing of the information of employees, retired workers, pensioners, and candidates for vacancies:

Purposes related to the employment relationship (EPS, ARL, pension and severance funds, family compensation funds, and other entities)
For employees, the signature of the employment contract is the express authorization to process the information
Accounting and payment of payroll
Recruitment and selection of personnel for vacancies
Processing, confirmation, and compliance with legal and extralegal labor obligations from the employment contract
Audits
Statistical analysis
Training and education
Share personal data with banking entities, companies that give benefits to the active workers of FLUIDSIGNAL GROUP S.A.S., and other entities
Occupational health and safety programs
Technological and physical access controls to keep the physical infrastructure of the facilities and applications secure
Transfer and/or transmission of personal data to entities and/or judicial and/or administrative authorities, when the company requires this for its corporate purpose and it is necessary for the functions of the company
Consultation and/or verification of the information in national and international control lists about money laundering and terrorist financing, illicit activities, or situations that the Colombian penal code regulates
Home safety visits and socioeconomic studies when the company requires them
Confirmation of the personal information that the employee gives, through a comparison with public databases, central and risk prevention systems, specialized companies, references, and contacts

Other databases that can exist and that are not directly related to the company are processed for pre-contractual, contractual, post-contractual, commercial, customer service, and marketing purposes, processing, research, training, accreditation, consolidation, organization, updates, reports, statistics, surveys, attention, and processing.

Rights of the information owner

The owner of the personal data has these rights:

Know, update, and rectify their personal data with the data controllers or data processors. The owner can use this right, for example, against partial, inaccurate, incomplete, fragmented, or misleading data, or data whose processing is expressly prohibited or not authorized.
Request proof of the authorization given to the data controller, except when the law expressly excepts it as a requirement for the processing, in accordance with the provisions of Article 10 of this law.
Get information from the data controller or the data processor, when the owner asks, about the use of their personal data.
Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of this law and of other regulations that change, add to, or complement it.
Revoke the authorization and/or request the deletion of the data when the processing does not respect constitutional and legal principles, rights, and guarantees.
The revocation and/or deletion applies when the Superintendency of Industry and Commerce determines that, in the processing, the Controller or Processor did actions contrary to this law and the Constitution.
Get access, free of charge, to their processed personal data.

Legitimization for the exercise of data subject rights

These people can exercise the rights of the owners:

The owner, who must prove their identity sufficiently through the different means that the person responsible makes available
The successors of the owner, who must prove this status
The representative and/or attorney of the owner, after they prove the representation or power of attorney
A person in whose favor, or for whom, a stipulation exists

The people who have the power to represent children or adolescents exercise the rights of these children or adolescents.

Responsible for managing requests

FLUIDSIGNAL GROUP S.A.S designates the administrative and financial area, or the area that replaces it, to receive, process, and channel the different requests. This area must process the requests of the owners in the terms, deadlines, and conditions of current regulations. These requests are for the rights of access, consultation, rectification, update, deletion, and revocation that each person has over their personal data.

Channels and procedures for data subjects to exercise their rights

The owner can file a claim with FLUIDSIGNAL GROUP S.A.S. if they think that someone must correct, update, or delete the information in a database. The owner can also file a claim if they see the alleged breach of any of the duties of the law. The owner or another authorized person must submit the request for rectification, update, or deletion through the medium that FLUIDSIGNAL GROUP S.A.S enables. For well-being, confidentiality, and agility in attention, FLUIDSIGNAL GROUP S.A.S designates the email [email protected].

The request must contain this information:

The name, identification document, and address of the owner, or any other means to receive the response.
Documents that prove the identity of the representative of the owner.
The description of the personal data for which the owner wants to exercise any of the rights.

Effectiveness

This policy applies to the personal databases for which the company is responsible and in charge. It comes into effect when FLUIDSIGNAL GROUP S.A.S. signs it, and it complements the related policies and formats, with indefinite validity.

Any significant change (in structure or in updates of regulations) in the personal data processing policies goes to the data owners in a timely manner. The company uses the usual means of contact and/or its website for this.

Some owners do not have access to electronic media, or the company cannot contact them. These owners get the communication through open notices at the main headquarters of the company.

The database policy has an indefinite period of validity, in accordance with the duration of the corporate purpose of the company.

The databases that record personal data have a validity equal to the time during which the company keeps and uses the information for the purposes of this policy.

When the company completes that purpose, it deletes the data of the owner from its databases. This does not apply if there is a legal or contractual duty to keep the information of the owner.

FLUIDSIGNAL GROUP S.A.S. shares this policy with workers by email and publishes it on the website of the company for their information.

Validity and application

This policy applies from its publication and effective communication to all workers through digital channels. It repeals the provisions that are contrary to it. It follows the guidelines of Law 1581 of 2012, Law 1032 of 2006, and/or later laws that change what they regulate.