DATA PROTECTION POLICY

1. GENERAL


1.1. TECFOOD SERVICIOS DE ALIMENTACIÓN SA is a company committed to and respectful of the rights regarding the personal data of natural persons, recognized in Article 66, paragraph 19, and Article 92 of the Constitution of the Republic of Ecuador, in the Organic Law on the Protection of Personal Data (hereinafter “LOPDP”), and other applicable regulations. Therefore, they make their Personal Data Protection Policy available to their clients, employees, and suppliers.


1.2. TECFOOD SERVICIOS DE ALIMENTACIÓN SA is a legally constituted company in Ecuador, owner of the trade name (title 798), product brand and service brand HANASKA LOGO, registered in international classes 91, 29 and 43.


1.3. TECFOOD SERVICIOS DE ALIMENTACIÓN SA maintains its policy publicly available. Therefore, by accessing and using its website https://hanaska.com/, hereinafter referred to as “the website,” the user (data subject) declares that they understand and accept the terms and conditions located in the “Personal Data Protection Policy” section and expressly grants their free, specific, informed, and unambiguous consent, using electronic means for this purpose. This policy may be updated at TECFOOD SERVICIOS DE ALIMENTACIÓN SA's discretion without prior notice.

 

1.4. If the holder does not fully and completely accept the terms and conditions of this notice, they must refrain from sharing any type of information with TECFOOD SERVICIOS DE ALIMENTACIÓN SA by any means, including its website.

 

1.5. If the owner continues to use the TECFOOD SERVICIOS DE ALIMENTACIÓN SA website, whether in whole or in part, this action will be considered as their absolute and express acceptance and consent to the terms and conditions established herein.

 

1.6. The mere use of the website https://hanaska.com/, managed by TECFOOD SERVICIOS DE ALIMENTACIÓN SA, grants the public the status of owner (hereinafter referred to as the “owner” or the “owners”) and implies the full and unconditional acceptance and consent of the owner to each and every one of the general and specific conditions included in the version of this policy published by TECFOOD SERVICIOS DE ALIMENTACIÓN SA

 

1.7. TECFOOD SERVICIOS DE ALIMENTACIÓN SA and the owner declare that, since there is no error, fraud, bad faith or any other defect of consent that could invalidate this instrument, they agree to be bound by the provisions stipulated in the following terms:


 

2. DEFINITIONS

 

2.1. Authorization: Prior, express, informed and revocable consent of the

 

Owner to carry out the Processing of Personal Data.

 

2.2. Privacy Notice: Communication generated by the Controller or Processor of Personal Data, addressed to the Data Subject for the Processing of their Data, informing them of the existence of the Data Processing Policy that will be applied, how to access it, and the purposes intended for the Personal Data.

 

2.3. Database: An organized set of Personal Data that is subject to Processing.

 

2.4. Clients: Natural or legal person who maintains a direct commercial relationship with TECFOOD SERVICIOS DE ALIMENTACIÓN SA

 

2.5. Collaborator: The worker, a natural person, who provides his professional services under a relationship of dependency or professional services contract to TECFOOD SERVICIOS DE ALIMENTACIÓN SA

 

2.6. Related or Subsidiary Companies: Any company that is part of the commercial activities carried out by TECFOOD SERVICIOS DE ALIMENTACIÓN SAt is considered a related company.

 

2.7. Confidentiality: Guarantee given by the Controller or Processor of Personal Data, that Personal Data will be protected and will not be disclosed in accordance with the provisions of the LOPDP.

 

2.8. Cookies: Passive information from the Holders that has been collected through the various technological channels, managed by TECFOOD SERVICIOS DE ALIMENTACIÓN SA or its Related Companies.

 

2.9. Consent: A freely given, specific, informed and unambiguous expression of the will by which the data subject authorizes the controller of the personal data to process the same.

 

2.10. Biometric data: Unique personal data relating to the physical or physiological characteristics or behaviors of a natural person that allows or confirms the unique identification of said person, such as facial images or fingerprint data, among others.

 

2.11. Personal Data: Any information that identifies or makes identifiable a natural person, directly or indirectly.

 

2.12. Sensitive Data: Data relating to ethnicity, gender identity, cultural identity, religion, ideology, political affiliation, criminal record, immigration status, sexual orientation, health, biometric data, genetic data and those whose improper processing may give rise to discrimination, threaten or may threaten the fundamental rights and freedoms of their Holders.

 

2.13. Data Protection Officer: Natural person who serves as a communication link between the Data Subjects, the Data Controller or Processor and the Personal Data Protection Authority.

 

2.14. Personal Data Processor: Natural or legal person, who alone or jointly with others, processes Personal Data on behalf of and for the account of a Personal Data Controller, guaranteeing full compliance with the requirements of the LOPDP.

 

2.15. Purpose of Personal Data Processing: This refers to the purpose or reason why TECFOOD SERVICIOS DE ALIMENTACIÓN SA collects, uses, stores or processes personal data, and gives rise to the relationship between TECFOOD SERVICIOS DE ALIMENTACIÓN SA and the data subject.

 

2.16. Data Controller: Natural or legal person who alone or jointly with others decides on the purpose of the processing of personal data.

 

2.17. Claim: Request from the Personal Data Holder or persons authorized by the holder or by law to correct, update or delete their Personal Data or to revoke the Authorization.

 

2.18. Data Subject: Natural person whose Personal Data is processed by TECFOOD SERVICIOS DE ALIMENTACIÓN SA or its Personal Data Processors.

 

2.19. Transfer or communication: Any manifestation, declaration, delivery, consultation, interconnection, assignment, transmission, dissemination, disclosure, or any other form of disclosure of personal data to a person other than the data subject, controller, or processor. The personal data communicated must be accurate, complete, and up-to-date.

 

2.20. Processing: Any operation or set of operations performed on personal data, whether by automated, partially automated or non-automated technical procedures, such as: collection, compilation, obtaining, recording, organization, structuring, storage, custody, adaptation, modification, deletion, indexing, extraction, consultation, elaboration, use, possession, exploitation, distribution, assignment, communication or transfer, or any other form of enabling access, comparison, interconnection, limitation, erasure, destruction and, in general, any use of personal data.

 

2.21. TECFOOD FOOD SERVICES SA: TECFOOD FOOD SERVICES SA is a legally constituted company in Ecuador and owner of the trade name, product brand and service brand of HANASKA LOGO.

 

2.22. Third Party: The natural or legal person, national or foreign, other than the Owner, Responsible, Processor and Delegate of Personal Data.


 

3. OBJECTIVE OF THE POLICY

 

The Personal Data Protection and Processing Policy (hereinafter the “Policy”) applies to all personal data subject to processing by TECFOOD SERVICIOS DE ALIMENTACIÓN SA as the Controller, to the Processor(s) that it may appoint, its related companies and all subjects involved in its processing, management of databases and physical or digital files, in accordance with the express, voluntary, unequivocal, informed and specific consent duly granted by its owners for its legitimate and lawful processing.

 

Therefore, TECFOOD SERVICIOS DE ALIMENTACIÓN SA clarifies that confidential, commercial, and strategic information is one of its most important assets, and, therefore, this information has special protection, since it is vitally important to guarantee the confidentiality and security of its databases, both for the well-being of the owners, as well as for binding corporate regulations.


 

4. SCOPE OF APPLICATION

 

This Policy applies to all members of the company and to third parties providing services, regardless of their hierarchical position within TECFOOD SERVICIOS DE ALIMENTACIÓN SA or their responsibilities. Therefore, TECFOOD SERVICIOS DE ALIMENTACIÓN SA requires that its members be sufficiently trained to ensure compliance with this Policy, both internally and by third parties acting on behalf of the company.

 

Our Policy guarantees compliance with current legislation on the protection of personal data and with any future regulations that may govern or modify it.


 

5. CONTROLLER OF PERSONAL DATA

 

The Data Controller for the Personal Data of the Data Subjects is TECFOOD SERVICIOS DE ALIMENTACIÓN SA, who undertakes to respect the provisions of this Policy.

 

Address: Isaac Albéniz E3-78 and Mozart. Quito, Ecuador. Email: protecciondedatos@hanaska.comex


 

6. PERSONS IN CHARGE OF PROCESSING PERSONAL DATA

 

TECFOOD SERVICIOS DE ALIMENTACIÓN SA maintains internal contracting procedures that regulate, guarantee, and establish the specific and appropriate measures to be taken regarding the contracting of services from suppliers who are granted access to data through the role of Data Processor. Similarly, there may be suppliers who, while not being Data Processors, may incidentally access personal data under the responsibility of TECFOOD SERVICIOS DE ALIMENTACIÓN SA. The provision of these services will be governed by the corresponding data processing agreements or by including addenda to the main service agreement.

7. DATA PROTECTION OFFICER


TECFOOD SERVICIOS DE ALIMENTACIÓN SA will appoint a Data Protection Officer, who will be responsible for the development, implementation, training, and enforcement of this Policy. To comply with this, all employees who process Personal Data within the different areas of TECFOOD SERVICIOS DE ALIMENTACIÓN SA are obligated to report any incident involving the company's databases to their respective Data Protection Officer and to immediately forward all complaints, claims, or requests they receive in the future from the Data Subject.


The Personal Data Protection Officer is responsible for addressing requests, inquiries, complaints and claims, since the Data Subject may exercise their rights recognized in the LOPDP.


Direct contact with the Data Protection Officer: protecciondedatos@hanaska.com



8. PRINCIPLES ON DATA PROCESSING


The processing of personal data carried out by TECFOOD SERVICIOS DE ALIMENTACIÓN SA will be governed by the principles of legality, loyalty, transparency, purpose, relevance, minimization, proportionality, confidentiality, quality, accuracy, conservation, security, proactive and demonstrated responsibility, in favor of the Data Subject.


TECFOOD SERVICIOS DE ALIMENTACIÓN SA may establish in the future, binding corporate regulations on Personal Data, as established in the LOPDP and future guidelines of the Personal Data Protection Authority.


TECFOOD SERVICIOS DE ALIMENTACIÓN SA is committed to always maintaining continuous improvement processes in this area.


These principles will be applied to all forms of Data Processing.



9. FUNCTIONS AND OBLIGATIONS OF THE DATA CONTROLLER


TECFOOD SERVICIOS DE ALIMENTACIÓN SA acknowledges that Personal Data is the sole property of the Data Subjects and only they may decide on its processing. TECFOOD SERVICIOS DE ALIMENTACIÓN SA undertakes to use the Personal Data collected solely and exclusively for the purposes established in this document.


9.1. Tests with real data


Any type of test prior to the execution or modification of security systems or information processing that handles personal data databases will be communicated to the Personal Data Protection Officer of TECFOOD SERVICIOS DE ALIMENTACIÓN SA, and he, in strict compliance with the Law, must approve or reject the process.


9.2. Control measures


Through the effective performance of the functions entrusted to TECFOOD SERVICIOS DE ALIMENTACIÓN SA, the Data Protection Officer will provide support during internal audits to verify compliance with this Policy and the Spanish Data Protection Act (LOPDP) at all levels. Likewise, the Data Protection Officer will determine the scope of new processes that align with the Processing Purposes established in this Policy.



10. PROCESSING AND PURPOSES OF PERSONAL DATA


TECFOOD SERVICIOS DE ALIMENTACIÓN SA may process the Personal Data of the HOLDER, directly and/or through Data Processors, in accordance with the type of relationship it maintains with the HOLDER, for the following purposes:


10.1. The Holder – Candidate for collaborator


a) To contact the HOLDER-candidate for collaborator, by any means, in order to follow up and evaluate the experience and studies of the HOLDER-candidate for collaborator, to know the viability of being selected and the possibilities of success in the position he intends to perform.


b) To know the work experience of the HOLDER-candidate for collaborator, as well as their skills for the position they intend to fill.


c) Create a file for the HOLDER-candidate to collaborator that will be kept in the offices of TECFOOD SERVICIOS DE ALIMENTACIÓN SA, in physical and/or digital format, for a period of one year from the date it is delivered.


d) Conduct research and socioeconomic studies to verify the information provided by the HOLDER-candidate for collaborator.


e) Carry out the procedures for the selection and administration of personnel in the


government institutions as required.


f) Contact the people that the HOLDER-candidate for collaborator has indicated as personal and/or work references.


g) Process Sensitive Personal Data such as the physical and mental health data, past and present of the HOLDER-candidate for collaborator, through the request of clinical and medical studies, to evaluate the possibilities of being hired for the required position.



10.2. The Owner – Collaborator


a) Carry out the activities contained in section 10.1 of this Policy in addition to those contemplated below:


b) Create a physical and/or digital file of the OWNER-Collaborator that will be kept at the address established by TECFOOD SERVICIOS DE ALIMENTACIÓN SA for the entire term of the employment relationship and for 15-fifteen years after its termination.


c) To process the credit data of the HOLDER-Collaborator in order to carry out the necessary procedures for the payment of payroll and other benefits generated in favor of the HOLDER-Collaborator.


d) To carry out the control of attendance and entry and exit times of the HOLDER-Collaborator to the offices of TECFOOD SERVICIOS DE ALIMENTACIÓN SA, in the processing of their biometric data.


e) Assign the OWNER-Collaborator the necessary tools and work resources for the development of the assigned functions.


f) Carry out the necessary procedures for registration, modifications and deletion before the government institutions that are required.


g) Process personal data of a special category in relation to the information provided by the collaborator on spouses, partners and/or family dependents.


h) Make the corresponding payments to the beneficiaries of alimony, if required by judicial authority.


i) Process the company's own life insurance and benefits.


j) To process sensitive personal data such as past and present physical and mental health data of the HOLDER-Collaborator, through the request for clinical and medical studies, to evaluate the health of the collaborator according to the parameters established by the occupational physician of TECFOOD SERVICIOS DE ALIMENTACIÓN SA


k) To process the specially protected personal data of employees with disabilities who are on the payroll.


l) Process requests for updating the collaborator's personal data.


m) Other activities related to the performance of the collaborator depending on their area of work.



10.3. The Holder – Prospective Client


a) To contact the OWNER-Prospective Client by telephone, email, social media or any other electronic messaging platform, to attend to and follow up on requests for products and/or services offered by TECFOOD SERVICIOS DE ALIMENTACIÓN SA


b) To provide the OWNER-Prospective Client with the products and/or services that TECFOOD SERVICIOS DE ALIMENTACIÓN SA markets, according to the requests made through any means, so that the OWNER-Prospective Client can benefit from them.


c) To contact the OWNER-Prospective Client by any means, in order to advertise the products and/or services offered by TECFOOD SERVICIOS DE ALIMENTACIÓN SA


d) Generate a record in the Customer Prospect database, which will be kept for 15-fifteen years.


e) To process the personal data of the HOLDER-Prospective Client of an identification and credit nature in order to deliver a quote for the products and/or services of TECFOOD SERVICIOS DE ALIMENTACIÓN SA



10.4. The Holder – Client of the industrial and hospital segment


a) Carry out the activities contained in section 10.3 of this Policy in addition to those contemplated below:



b) Contact the OWNER-Client by any means, in order to make clarifications and follow up on payments, or any other situation derived from the products and/or services provided by TECFOOD SERVICIOS DE ALIMENTACIÓN SA, as well as complaints or comments.


c) Register and update the data in the internal business administration system, for access to Personal Data by the persons authorized to do so.


d) Coordinate communications with the OWNER-Client by: telephone, email or physically.


e) Generate a record in the Customer database, which will be kept for the duration of the business relationship and up to 15 years thereafter.


f) To create and store a physical and/or electronic file of the HOLDER-Client for the duration of the business relationship and for up to 15 – fifteen years after the termination of the business relationship.


g) Contact the HOLDER-Client to carry out the collection of debts; where appropriate, contact the persons that the HOLDER-Client has authorized as payment contacts.


h) Issuance of invoices and credit notes derived from the marketing of products and/or services offered by TECFOOD SERVICIOS DE ALIMENTACIÓN SA. These invoices, in physical and/or electronic format and the credit notes, will be kept by TECFOOD for a period of 15 years from their issuance.


i) Verify in the credit bureau and other financial platforms that allow verification of the origin of the funds with which the HOLDER-Client acquires the products and/or services offered by TECFOOD SERVICIOS DE ALIMENTACIÓN SA



10.5. The Holder – Client educational segment


a) Carry out the activities contained in section 10.4 of this Policy, which apply to the HOLDER-Client educational segment in addition to those contemplated below:


b) Carry out marketing campaigns in accordance with the data collected in the databases of TECFOOD SERVICIOS DE ALIMENTACIÓN SA, with prior authorization from the OWNER-Client educational segment, through applications of TECFOOD SERVICIOS DE ALIMENTACIÓN SA, social networks and other electronic means that TECFOOD SERVICIOS DE ALIMENTACIÓN SA considers appropriate.


c) Collect the biometric data of the HOLDER-Client educational segment, including, but not limited to, fingerprints and facial recognition, to provide adequate service in our cafes.


d) Collect the personal data of the HOLDER-Client educational segment, to carry out a purchase registration process.


e) Contact the OWNER-Client educational segment for the issuance of invoices and collection of debts.

f) Manage the data of the OWNER-Client educational segment for the development of TECFOOD applications and customer service services.


g) Register them in your accounting system and in the billing control system for access to Personal Data by the persons authorized to do so.



10.6. The Holder – Visitor to the physical offices of TECFOOD SERVICIOS DE ALIMENTACIÓN SA


a) To store in different databases the information of visitors to the premises of TECFOOD SERVICIOS DE ALIMENTACIÓN SA, in order to maintain control of the entries and exits of those who visit its facilities, which will be kept for a period of one year from when they are obtained unless a commercial relationship is established with the visitor.


b) Store the images obtained through video surveillance services for a retention period of between thirty and forty-five days from the time they were captured.



10.7. The Owner – User of the Website, social networks and application of TECFOOD SERVICIOS DE ALIMENTACIÓN SA (Owner – User)


a) Contact the OWNER-User, via email, via telephone, through social networks or by any other means, to address and follow up on their comments or requests for services and/or products.


b) To access the social networks in which TECFOOD SERVICIOS DE ALIMENTACIÓN SA participates



c) To send information and promotions, after prior communication made by the OWNER-User through the pop-up available on the INTERNET PAGE of TECFOOD SERVICIOS DE ALIMENTACIÓN SA, under the name of “Contact”.


d) To store in different databases, in physical or electronic format, the information of users of the Website, social networks and applications of TECFOOD SERVICIOS DE ALIMENTACIÓN SA, said records will be stored for a period of 1-one year from the date of their collection, provided that no commercial operations are carried out with TECFOOD SERVICIOS DE ALIMENTACIÓN SA



10.8. The Holder – Supplier, Prospective Supplier and/or Service Provider (collectively referred to as “Supplier”)


a) To contact you by telephone, email or any other means, to request or follow up on requests for information, services and/or products required by TECFOOD SERVICIOS DE ALIMENTACIÓN SA


b) Register the Supplier's profile in the internal administration system for access by authorized personnel, which will be kept for the duration of the business relationship with the OWNER-Supplier and for 15-fifteen years after its termination.


c) Contact the OWNER-Supplier by any means, in order to make clarifications and follow up on payments or any other situation derived from the services required by TECFOOD SERVICIOS DE ALIMENTACIÓN SA


d) To keep for a period of 15-fifteen years from the date they are generated, the invoices and credit notes, in physical and/or electronic format, derived from the products and/or services required by TECFOOD SERVICIOS DE ALIMENTACIÓN SA


e) Keep for a period of 15- fifteen years the contracts that the company enters into with the OWNER-Supplier in both physical and electronic format, from the date on which they expire.


f) To make bank transfers in connection with requests for products and/or services made by TECFOOD SERVICIOS DE ALIMENTACIÓN SA


g) Keep a physical and/or electronic file of the OWNER-Supplier for the duration of the business relationship and for 15-fifteen years after its termination for any reason.


h) Register them in your accounting system and in the billing control system for access to Personal Data by the persons authorized to do so.


i) Register personal data of an identifying nature to register petty cash payments.

11. RIGHTS OF THE DATA SUBJECTS


Data subjects who have provided personal data to TECFOOD SERVICIOS DE ALIMENTACIÓN SA, which is subject to processing, have the right to exercise the following rights at any time:

a) To be informed about which Personal Data TECFOOD SERVICIOS DE ALIMENTACIÓN SA processes.


b) Access the Personal Data that TECFOOD SERVICIOS DE ALIMENTACIÓN SA holds about the Owner.


c) Request, at any time, that your Data be updated, rectified or deleted, when your request complies with the grounds of the LOPDP.


d) Request from TECFOOD SERVICIOS DE ALIMENTACIÓN SA proof of the authorization granted for the processing of your personal data.


e) To be informed by TECFOOD SERVICIOS DE ALIMENTACIÓN SA upon request, regarding the current use they have made of your personal data.


f) Formally request TECFOOD SERVICIOS DE ALIMENTACIÓN SA to delete your personal data and/or revoke the Authorization granted for its Processing, by submitting a claim, in accordance with the procedures established in this Policy. However, the request for deletion of information and the revocation of Authorization will not be granted when the Data Subject has an active commercial, contractual, or legal relationship with TECFOOD SERVICIOS DE ALIMENTACIÓN SA with the obligation to remain in the Database and/or Files of said company.


g) Access your Personal Data that has been processed, free of charge.



12. PROCESSES FOR EXERCISING THE RIGHTS OF DATA SUBJECTS OVER THEIR PERSONAL DATA


TECFOOD SERVICIOS DE ALIMENTACIÓN SA has established a series of procedures that determine the rules to be followed by the Owners.


The employees of TECFOOD SERVICIOS DE ALIMENTACIÓN SA have accepted and are aware of both their roles and obligations regarding Data Protection, and it is for this reason, in order to facilitate and guarantee compliance with the LOPDP (Spanish Data Protection Law), the present procedures have been established, which will be approved or rejected by the Data Protection Officer of TECFOOD SERVICIOS DE ALIMENTACIÓN SA


It is necessary to establish that not all procedures will be applicable to all Holders, since they may only activate them when justified based on the provisions of the Law.


12.1. Requests from Data Subjects – Personal Data Protection Officer.


Should the Data Subject wish to revoke their consent, as well as access, rectify, cancel, or oppose the processing of their personal data that they have provided, they must do so through the person designated by TECFOOD SERVICIOS DE ALIMENTACIÓN SA as Data Protection Officer, for which they must contact via email: protecciondedatos@hanaska.com


12.2. Means to revoke consent


The Data Subject may revoke their consent or authorization. Such revocation of consent must be carried out following the procedure below:


1. Send an email addressed to the Data Protection Officer containing:


a. Name of the requirement;

b. Full name of the Holder, address and email address to receive the response generated as a result of your request;

c. The justified reason for your request;

d. The arguments that support your request or petition;

e. Official document proving your identity, and;

f. Date from which the revocation of your consent becomes effective.


2. Provide any information requested by TECFOOD SERVICIOS DE ALIMENTACIÓN SA to carry out the Holder's claim.


TECFOOD SERVICIOS DE ALIMENTACIÓN SA will notify the Data Subject, within a maximum of 15 days from the day following receipt of the request to revoke consent, of the decision adopted, so that, if applicable, it may be implemented within 15 days following the date on which the response is communicated. The response will be communicated via email informing the Data Subject that all actions necessary to cease the Processing for which said Authorization was collected have been carried out.


12.3. Means to exercise the Rights of Access, Rectification, Elimination and Opposition


If the Data Subject wishes to Access, Rectify, Delete or Oppose the Personal Data that he/she has provided to TECFOOD SERVICIOS DE ALIMENTACIÓN SA, he/she must follow the following procedure:


1. Send an email addressed to the Data Protection Officer, who will handle these requests, indicating the following:


a. Full name of the Holder, address and email address to receive the response generated as a result of your request;

b. The reason for your request;

c. The arguments that support your request or petition;

d. Copy of the official document that proves your identity;

e. Clear and precise description of the Personal Data regarding the rights that are sought to be exercised;

f. In the case of requests for rectification of Personal Data, the Holder must indicate, in addition to the above, the modifications to be made and provide the documentation that supports his request.

g. For any request to be valid, the Holder must follow and comply with the specific guidelines set forth in the LOPDP.


2. Provide any information requested by TECFOOD SERVICIOS DE ALIMENTACIÓN SA to carry out the Holder's claim.



13. AUTHORIZATION


Prior to receiving Personal Data by any means, it is mandatory to have the free, express, specific, informed, unequivocal and revocable consent in favor of TECFOOD SERVICIOS DE ALIMENTACIÓN SA for the lawful and legitimate purposes specifically determined in this Policy.


This declaration from the Holders will be obtained through different mechanisms implemented by TECFOOD SERVICIOS DE ALIMENTACIÓN SA, for example:


a) Through any written document, which must include an Authorization for the Processing of Personal Data in favor of TECFOOD SERVICIOS DE ALIMENTACIÓN SA. Orally and expressly, through a telephone call that is recorded by TECFOOD SERVICIOS DE ALIMENTACIÓN SA


b) Through any technological means that expressly records the will of the Holders in favor of TECFOOD SERVICIOS DE ALIMENTACIÓN SA



14. INTERNATIONAL TRANSFERS OF PERSONAL DATA


TECFOOD SERVICIOS DE ALIMENTACIÓN SA may transfer personal data internationally. In this case, the company will ensure that any processing requiring an international transfer of personal data is carried out in accordance with the provisions of the current Spanish Data Protection Act (LOPDP) and its supplementary regulations.


TECFOOD SERVICIOS DE ALIMENTACIÓN SA will verify that whoever receives personal data abroad has adequate levels of protection, equal to or greater than current Ecuadorian regulations.



15. IMPLEMENTATION OF THE PERSONAL DATA PROTECTION MANAGEMENT SYSTEM


In accordance with the principles and standards included in this Policy, TECFOOD SERVICIOS DE ALIMENTACIÓN SA will maintain the continuous development of internal procedures, or any other supporting documentation that allows for the implementation of current Ecuadorian regulations, applying an internal data protection management system. These procedures, documents, and other instruments will be binding on all members of TECFOOD SERVICIOS DE ALIMENTACIÓN SA




16. SUPPLIER SECURITY


TECFOOD SERVICIOS DE ALIMENTACIÓN SA will maintain special care and attention when evaluating the criticality and possible risks of those services susceptible to subcontracting, in such a way that those that are relevant from the point of view of the security of information and Personal Data can be identified, whether this is due to their sensitivity or nature, always depending on the continuity of business.


In those subcontracted services, the following must be observed and taken care of: selection processes, contractual requirements such as contract termination, monitoring of service levels, data return and the security measures implemented by said provider, which must be, at least, equivalent to those established in Ecuadorian regulations and in this Policy.

17. CONTROL AND EVALUATION OF THE PERSONAL DATA PROTECTION MANAGEMENT SYSTEM


TECFOOD SERVICIOS DE ALIMENTACIÓN SA will maintain a data protection management system, which will be monitored and evaluated periodically. To this end, audits may be carried out to verify compliance with this Policy and all applicable data protection regulations, under the direction and supervision of the Data Protection Officer of TECFOOD SERVICIOS DE ALIMENTACIÓN SA.


Similarly, the Internal Audit area, in compliance with its functions and in accordance with its annual review plan for TECFOOD SERVICIOS DE ALIMENTACIÓN SA, will include a specific section on Data Protection in order to monitor compliance with applicable regulations.


The results obtained from the different audits, whether through the Internal Audit area or through the Personal Data Protection Officer, must be communicated directly to the General Management of TECFOOD SERVICIOS DE ALIMENTACIÓN SA, so that specific actions can be taken.



18. PROCESSING OF SENSITIVE AND SPECIAL CATEGORY DATA


TECFOOD SERVICIOS DE ALIMENTACIÓN SA guarantees that it will process Sensitive and Special Category Personal Data collected under security and confidentiality standards appropriate to its nature. To this end, TECFOOD SERVICIOS DE ALIMENTACIÓN SA will implement administrative, technical, and legal measures contained in its internal regulations, which are mandatory for its employees and, where applicable, for its suppliers, affiliated companies, and business partners.



19. PERSONAL DATA RETENTION PERIOD


Personal Data of an i) identification nature, ii) sensitive nature, iii) credit nature, iv) relating to health, and, v) special categories, will be kept by TECFOOD SERVICIOS DE ALIMENTACIÓN SA for the standard period of 15 – fifteen years.


Personal Data that has a retention period other than the standard one is specified within this Policy.



20. TYPES OF INFORMATION


TECFOOD SERVICIOS DE ALIMENTACIÓN SA will classify the information according to the medium on which it is being used, in order to maintain continuous improvement processes on this:


a) Software: Information that is being used through office automation, email or information systems developed to order or acquired from a third party.


b) Physical media: Information that is on paper, magnetic media such as USB, DVD, among others.



20.1. Classification levels



TECFOOD SERVICIOS DE ALIMENTACIÓN SA will categorize the information according to its sensitivity in five levels.


Public use: Information that is easily accessible and can be found on the websites of state entities.


Limited dissemination: Information that requires some care and limited access.


Confidential information: Information classified as such through confidentiality agreements signed by TECFOOD SERVICIOS DE ALIMENTACIÓN SA, access to which is restricted to certain collaborators.


Confidential information: Information classified as such through confidentiality agreements signed by TECFOOD SERVICIOS DE ALIMENTACIÓN SA, access to which is restricted to certain collaborators.


5. Secret information: Information classified as such through confidentiality agreements signed by TECFOOD SERVICIOS DE ALIMENTACIÓN SA, access to which is restricted to most collaborators.



20.2. Information Labeling



TECFOOD SERVICIOS DE ALIMENTACIÓN SA will label the collected information, using manual or automated methods (depending on its complexity and availability) to facilitate the appropriate processing of the security measures that apply in each case.


Documents or materials, as well as annexes, copies, translations or extracts thereof, will be labelled according to the information classification levels defined in this section, except for information considered to be for "Public Use".




A process or procedure for labeling information must be defined in accordance with the following requirements:


Ensure that the labeling of information reflects the adopted information classification scheme.


Ensure that the labels are easily recognizable among all collaborators.


Guide employees on where and how labels will be placed or used, depending on the process of accessing information or the assets that support it.


Indicate the exceptions in which labeling is permitted to be omitted, without this implying an omission of the duty to classify the information.


TECFOOD SERVICIOS DE ALIMENTACIÓN SA will pay special attention and treat with the utmost care the labeling of physical assets that contain reserved or secret information, in order to prevent their theft; this is due to the easy identification after their labeling.


TECFOOD SERVICIOS DE ALIMENTACIÓN SA will establish the technical measures, if necessary, and feasible for automatic labeling of the information supported on digital media.


TECFOOD SERVICIOS DE ALIMENTACIÓN SA will ensure that all its employees are trained in labeling information. It will also specifically define the roles of those employees with access to confidential or secret information.



21. CONFIDENTIAL INFORMATION AND SENSITIVE COMMERCIAL INFORMATION


TECFOOD SERVICIOS DE ALIMENTACIÓN SA defines “confidential information” as information relating to the company or any of its members that, if disclosed, would cause harm to the company's financial situation, strategic planning, or reputation, as well as to the privacy of its members. Confidential information will always be the exclusive property of TECFOOD SERVICIOS DE ALIMENTACIÓN SA


As a general rule, all information generated in the course of TECFOOD SERVICIOS DE ALIMENTACIÓN SA's business activities by its members is confidential, including information disclosed to its own members due to the performance of their professional duties and generally not known outside of them, or protected by law.


In any case, the following information will always be confidential:


  • The general strategy of TECFOOD FOOD SERVICES SA;
  • Know-how;
  • Information about the company members;
  • Non-public information regarding the organizational chart, shareholding structure, finances, audit, insurance, or ongoing or completed legal proceedings in which the organization has been involved;
  • Public or private tenders in the bidding phase;
  • Information about the company's clients;
  • Information that has been labeled as sensitive by the company's management.


TECFOOD SERVICIOS DE ALIMENTACIÓN SA considers "sensitive commercial information" to be information that a company would not normally share with a third party outside of it, and in particular, information that would allow the recipient to know or anticipate the company's behavior in the market. By law, recent data is considered more sensitive than historical data.


Among the data that TECFOOD SERVICIOS DE ALIMENTACIÓN SA will consider sensitive from a Competition Defense perspective, the following stand out:


  • Current or future prices, including discounts, sales and promotions;
  • Sales figures, cost data or margins;
  • Market shares, data on capacity and production systems;
  • Identity of clients or suppliers (actual or potential);
  • Information on manufacturing technologies, intellectual or industrial property rights, or technical know-how;
  • Future business strategies, including the intention to participate or not in a tender or to submit bids in relation to a specific contract;
  • Strategies, budgets, plans or business or marketing policies;
  • Plans for business expansion or recruitment, or plans for access to new markets or withdrawal from a market in which TECFOOD SERVICIOS DE ALIMENTACIÓN SA or its competitors currently operate;
  • Forecasts of future offers, demand or supply conditions, or financial indicators.



22. STORAGE OF CONFIDENTIAL AND SENSITIVE COMMERCIAL INFORMATION


Confidential and sensitive commercial information will be stored in both physical and digital formats. TECFOOD SERVICIOS DE ALIMENTACIÓN SA will also have to determine the specific storage location for confidential and sensitive commercial information, as well as the security measures to prevent unauthorized access by individuals or organizations.


The storage of this confidential and sensitive commercial information on the personal devices of TECFOOD SERVICIOS DE ALIMENTACIÓN SA members, or on any other means not expressly authorized by the company (e.g., Dropbox, social networks or personal emails, among others), is expressly prohibited.



23. DISCLOSURE OF INFORMATION CLASSIFIED AS CONFIDENTIAL


Information labeled and classified as confidential may be disclosed in the following circumstances, always respecting the need-to-know principle: (i) when negotiating commercial proposals with clients, subject to the approval of the Head of the corresponding area; (ii) when such information is required by certain members of the company to carry out a specific task; (iii) when justifiably required by professionals external to the organization who need that information (i.e., auditors, lawyers, consultants, etc.); (iv) when certain information must be communicated to business partners of the company or related companies; (v) when required by a judicial or administrative authority; and (vi) in all cases where it is necessary for the ordinary course of business of TECFOOD SERVICIOS DE ALIMENTACIÓN SA


In order to proceed with the disclosure of confidential company information in accordance with the provisions of the preceding paragraph, the member making such disclosure shall ensure compliance with the following:


  • Transmit confidential information to its recipient through means that ensure the maintenance of confidentiality.


  • Inform the recipient of the information about its strictly confidential nature and their obligations in this regard, as set out in section 25 (“Company members, information classified as confidential and sensitive commercial information”).

    • 23. DISCLOSURE OF INFORMATION CLASSIFIED AS CONFIDENTIAL


    Information labeled and classified as confidential may be disclosed in the following circumstances, always respecting the need-to-know principle: (i) when negotiating commercial proposals with clients, subject to the approval of the Head of the corresponding area; (ii) when such information is required by certain members of the company to carry out a specific task; (iii) when justifiably required by professionals external to the organization who need that information (i.e., auditors, lawyers, consultants, etc.); (iv) when certain information must be communicated to business partners of the company or related companies; (v) when required by a judicial or administrative authority; and (vi) in all cases where it is necessary for the ordinary course of business of TECFOOD SERVICIOS DE ALIMENTACIÓN SA


    In order to proceed with the disclosure of confidential company information in accordance with the provisions of the preceding paragraph, the member making such disclosure shall ensure compliance with the following:


  • Transmit confidential information to its recipient through means that ensure the maintenance of confidentiality.


  • Inform the recipient of the information about its strictly confidential nature and their obligations in this regard, as set out in section 25 (“Company members, information classified as confidential and sensitive commercial information”).



    • 24. DISCLOSURE OF INFORMATION CLASSIFIED AS COMMERCIALLY SENSITIVE


    Current and binding competition law prohibits the exchange of sensitive commercial information between competitors. This prohibition applies to all contexts in which the exchange of sensitive commercial information may occur: industry associations, the formation of a joint venture with a competitor, subcontracting in public tenders, negotiations of mergers and acquisitions, or collaboration on market research or other projects of interest to the sector.


    In these cases, the exchange of information is considered contrary to the regulations to the extent that the information exchanged goes beyond what is necessary to successfully carry out the collaboration or project in question, even if no effective use is made of the information exchanged.


    Therefore, members of TECFOOD SERVICIOS DE ALIMENTACIÓN SA are required to consult with the Data Protection Officer before carrying out any questions about whether the exchange of information is permitted or not.


    In the event that a competitor sends or suggests exchanging sensitive information without consent, the employee must clearly and expressly refuse to receive or exchange such information and report the incident to their supervisor and the Data Protection Officer. If such information is received (for example, by email or during a meeting), the employee must contact the Data Protection Officer, who can provide legal and technical support to determine the appropriate legal, organizational, and contingency actions for TECFOOD SERVICIOS DE ALIMENTACIÓN SA.


    Any commercial information exchanged with third parties must receive the same treatment as confidential information as set out in sections 23 (“Disclosure of information classified as confidential”) and 26 (“Third parties, confidential information and sensitive commercial information”).



    25. COMPANY MEMBERS, INFORMATION CLASSIFIED AS CONFIDENTIAL AND COMMERCIALLY SENSITIVE


    All members of TECFOOD SERVICIOS DE ALIMENTACIÓN SA have a duty not to misuse or disclose confidential or sensitive commercial information. This obligation is expressly stipulated in the signed employment contracts or confidentiality agreements.


    Throughout the course of their employment, members of TECFOOD SERVICIOS DE ALIMENTACIÓN SA must use confidential and sensitive commercial information with absolute discretion and use it only for the development of their assigned professional work, always in compliance with this instrument.


    If a TECFOOD SERVICIOS DE ALIMENTACIÓN SA employee has any doubts or concerns regarding the confidentiality of the use or disclosure of confidential information, they should consult with their supervisor who will in turn consult with the Data Protection Officer.


    All members of TECFOOD SERVICIOS DE ALIMENTACIÓN SA are required to report any violation of this Policy that they become aware of, and must do so through their superior supervisor.



    26. THIRD PARTIES, CONFIDENTIAL INFORMATION AND SENSITIVE COMMERCIAL INFORMATION


    TECFOOD SERVICIOS DE ALIMENTACIÓN SA maintains the necessary measures to ensure that third parties with whom they maintain any kind of commercial or professional relationship are also obliged to maintain confidentiality of those documents received in relation to the company's activities.


    TECFOOD SERVICIOS DE ALIMENTACIÓN SA ensures that its members, before providing any type of confidential or sensitive commercial information, have verified that the recipients have assumed their obligation of confidentiality. This obligation of confidentiality will be set forth in the corresponding confidentiality agreement, which must be prepared and reviewed by the head of the relevant department.



    27. COOKIES


    A cookie is a file sent to your computer requesting permission to be stored there. Once you accept, the file is created and used to gather information about web traffic and facilitate future visits to a website. Another function of cookies is that they allow websites to recognize you individually and therefore provide you with a better, more personalized service.


    Our website uses cookies to identify which pages are visited and how often. This information is used solely for statistical analysis and is then permanently deleted. You can delete cookies from your computer at any time. While cookies help provide a better website experience, they do NOT grant access to your computer or personal information. Specifically, cookies may collect information about your computer hardware and software, IP address, browser type, operating system, domain name, access time, and referring website addresses; however, cookies do NOT directly collect Personal Data.


    You can accept or decline the use of cookies; however, most browsers automatically accept cookies as they help provide a better web service. You can also change your computer settings to decline cookies. If you decline them, you may not be able to use some of the services offered by TECFOOD SERVICIOS DE ALIMENTACIÓN SA.


    Website owners will always have the power to authorize, configure or deny the use of the cookie tool during the first access to the Website.



    28. APPLICABLE LEGISLATION


    Our Personal Data Protection Policy adheres to the provisions of the current LOPDP, its amendments, the Constitution of the Republic of Ecuador, and other regulations on the matter that are in force at the date of issuance of this policy and those that may be issued in the future.



    29. VALIDITY


    TECFOOD SERVICIOS DE ALIMENTACIÓN SA, recognizing the importance of data protection and the privacy of its clients, employees, and suppliers, has worked diligently for several months on the creation and review of this Personal Data Protection Policy. Finally, after a thorough study and analysis of its business operations, this policy was approved by the Management Committee on November 6, 2023.



    30. PROCESSING AND PURPOSES OF PERSONAL DATA


    Status No. Revision Date Observations Approval

    Original     1

    November 6, 2023

    Original version