Privacy Policy

Arias Aesthetics S.A.S., in compliance with Law 1581 of 2012 and other related regulations, is responsible for the processing of your personal data. The company is committed to adopting a policy aimed at protecting the privacy of personal information obtained through various means from its clients, suppliers, contractors, employees, and any third party with whom it has a relationship. Additionally, it reserves the right to modify this policy to adapt it to new legal requirements.

In accordance with Article 15 of the Political Constitution of Colombia and Law 1581 of 2012, as the owner of the information, you have the right to authorize the processing of your personal data, to know, update, and correct your personal data, and, in applicable cases, to delete or revoke the authorization granted for their processing.

I. OBJECTIVE

This policy aims to establish the guidelines that ensure the protection of personal data processed by Arias Aesthetics S.A.S. to comply with the regulation of rights holders, and criteria for the collection, storage, use, circulation, and deletion of personal data.

II. RECIPIENTS

This policy is directed to all individuals who consider themselves registered and wish to know, update, and correct the information collected about them. It applies to all databases, both physical and digital, containing personal data that are subject to processing by Arias Aesthetics S.A.S.

III. LEGAL FRAMEWORK

To ensure the proper processing and protection of third-party personal information by Arias Aesthetics S.A.S., Law 1581 of 2012, in its Article 25, created the National Database Registry – RNBD, regulated by Decree 1377 of 2013, Decree 886 of 2014, Decree 1074 of 2015, and subsequent regulations, which are duly applied through this document.

IV. GLOSSARY

The following definitions will apply in the development and interpretation of current regulations:

Privacy Notice: A verbal or written communication generated by the Responsible Party, directed to the Data Subject for the Processing of their personal data, informing them about the existence of the information Processing policies that will apply, how to access them, and the purposes of the intended Processing of personal data.

Authorization: Prior, express, and informed consent from the data subject for the processing of their personal data.

Database: An organized set of personal data that is subject to processing. This includes physical and electronic files.

Personal Data: Any information related to a natural person (an individual).

Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among others, information related to a person’s marital status, profession or occupation, and status as a merchant or public official.

Sensitive Data: Data that affects the privacy of the Data Subject or whose improper use could lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations, or those promoting the interests of any political party, as well as data related to health, sexual life, and biometric data.

Data Processor: A natural or legal person, public or private, who, on their own or in association with others, processes personal data on behalf of the data controller.

Data Controller: A natural or legal person, public or private, who decides on the database and/or the processing of the data.

Arias Aesthetics S.A.S. acts as the Data Controller for personal data concerning all the personal data over which it directly decides, in compliance with its legally recognized functions.

Data Subject: A natural person whose personal data is processed.

Transfer: The transfer of data occurs when the Data Controller and/or Data Processor located in Colombia sends the information or personal data to a recipient, who in turn is the Data Controller and is located inside or outside the country.

Transmission: The processing of personal data involving the communication of such data inside or outside the territory of the Republic of Colombia when it aims at carrying out processing by the Processor on behalf of the Controller.

Processing: Any operation or set of operations on Personal Data carried out by Arias Aesthetics S.A.S., such as collection, storage, use, circulation, or deletion.

V. PROCESSING AND PURPOSES

In accordance with current regulations and in compliance with the authorizations granted by the data subjects, Arias Aesthetics S.A.S. will perform operations including data collection, storage, use, circulation, and/or deletion. This data processing will be carried out exclusively for the purposes authorized and stipulated in this policy and the specific authorizations granted by the data subject.

The data will be collected and processed by Arias Aesthetics S.A.S. specifically for the following purposes:

• To develop the company’s corporate purpose.
• To send information related to the company and its service portfolio.
• To comply with applicable regulations for suppliers and contractors, particularly the Commercial code and the Tax Statute.
• To execute the existing commercial or contractual relationship with its clients and suppliers.
• To maintain permanent contact with clients and suppliers.
• To comply with the provisions of the Labor Code, Law 100 of 1993, and other regulations governing the General Social Security System.
• To develop the process of selection, evaluation, and hiring, as well as the processes required to fully comply with the employment relationship, including the granting of benefits.
• To establish communication channels with the Data Subject through email, phone calls, SMS, WhatsApp, instant messaging tools, or any communication channel known or to be known, as long as authorized by the Data Subject.
• To create synergies with other companies.
• To fulfill contractual obligations.
• Other purposes determined by Arias Aesthetics S.A.S. as the Data Controller in the processes of obtaining Personal Data for processing, and communicated to the Data Subjects at the time of data collection.

VI. RIGHTS OF THE DATA SUBJECTS

Arias Aesthetics S.A.S. will always respect the rights of Data Subjects whose personal data are processed. These rights include:

• Knowing, updating, and correcting the data held by Arias Aesthetics S.A.S.
• Requesting proof of the authorization granted, or any other that the Data Subject of personal data signs for this purpose, except when expressly exempted as a requirement for data processing in accordance with the law.
• Being informed by Arias Aesthetics S.A.S., upon request, about the use given to the data.
• Filing complaints before the competent authority for violations of the provisions in the law and other regulations that modify, replace, or add to it.
• Revoking the authorization and/or requesting the deletion of the data when the processing does not respect the constitutional and legal principles, rights, and guarantees. The revocation and/or deletion will proceed when the competent authority has determined that Arias Aesthetics S.A.S. has engaged in conduct contrary to the law and the Constitution in the processing, and provided there is no legal or contractual obligation to retain the personal data.
• Accessing the personal data that have been processed, free of charge.

VII. AUTHORIZATION OF THE DATA SUBJECT

Without prejudice to the exceptions provided by law, processing requires the prior and informed authorization of the Data Subject, which must be obtained by any means that can be subject to subsequent consultation. Authorization will be deemed to meet these requirements when expressed (i) in writing, (ii) orally, or (iii) through unequivocal conduct of the Data Subject that reasonably concludes that authorization was granted.

The Data Subject’s authorization will not be necessary in the following cases:

• Data of a public nature.
• Cases of medical or health emergencies.
• Processing of information authorized by law for historical, statistical, or scientific purposes.
• Data related to the Civil Registry of persons.

VIII. DUTIES OF ARIAS AESTHETICS S.A.S. – DATA CONTROLLER

Arias Aesthetics S.A.S., as the Data Controller.