FIRST. PURPOSE
To establish the principles, rules, responsibilities, and procedures governing the processing of personal data carried out by CCL Auditores Consultores (hereinafter “CCL”), ensuring compliance with Law No. 21,719, complementary regulations, and internal information security standards.
This policy forms an integral part of CCL’s corporate compliance system.
SECOND. SCOPE
This policy applies to:
•All employees, partners, directors, collaborators, interns, and third parties who process personal data on behalf of CCL.
•All activities, processes, systems, technological platforms, and contracts in which personal data is processed.
•The processing of data of:
o Clients and potential clients.
o Employees and applicants.
o Suppliers and contractors.
o Business contacts.
o Any natural person whose data is processed by CCL.
THIRD. RELEVANT DEFINITIONS
•Personal data: Any information related to or referring to an identified or identifiable natural person.
•Sensitive data: Data referring to physical or moral characteristics, health, biometrics, geolocation, financial data, among others defined by law.
•Data subject: The natural person to whom the data refers.
•Data controller: CCL, which determines the purposes and means of processing.
•Processor: Third party that processes data on behalf of CCL.
FOURTH. GUIDING PRINCIPLES
CCL commits to complying with the following principles:
•Purpose: Data will be collected for specific, explicit, and legitimate purposes.
•Proportionality and minimization: Only strictly necessary data will be processed.
•Quality: Data must be accurate, complete, and up to date.
•Accountability: CCL must demonstrate regulatory compliance.
•Security: Appropriate technical and organizational measures will be adopted.
•Transparency: Data subjects will be clearly informed.
•Confidentiality: Any person accessing personal data must maintain secrecy.
FIFTH. LEGAL BASIS FOR PROCESSING
The processing of personal data at CCL will be based on:
•Free, specific, informed, and unambiguous consent of the data subject.
•Execution of a contract or contractual measures.
•Compliance with legal obligations.
•Legitimate interest duly assessed.
•Defense of rights before courts.
•Other legal grounds provided by law.
Sensitive data will require explicit consent, unless a legal exception applies.
SIXTH. DATA SUBJECT RIGHTS
Data subjects may exercise the following rights:
•Access: The data subject has the right to request and obtain confirmation as to whether CCL is processing personal data concerning them.
•Rectification: The data subject has the right to request correction or updating of their personal data when it is inaccurate, incomplete, outdated, or incorrectly recorded. CCL will take all necessary measures once the request is verified.
•Erasure: The data subject may request deletion of their personal data when:
o The data is no longer necessary for the purposes for which it was collected.
o The data subject withdraws consent.
o There is a legal obligation to delete the data.
This right will not apply when processing is necessary for legal, contractual obligations or defense of rights.
•Objection: The data subject has the right to object when processing is based on legitimate interest or used for purposes different from those originally informed.
•Restriction of processing: The data subject may request limitation when:
o The accuracy of the data is contested,
o Processing is unlawful but deletion is not desired,
o The controller no longer needs the data but it is required for claims,
o An objection is pending evaluation.
Channel for exercising rights
CCL will enable a formal channel for requests related to data subject rights: XXXXXX
Requests must include:
•Identification of the data subject.
•Clear description of the right to be exercised.
•Information to locate the data.
•Contact details for response.
SEVENTH. SECURITY MEASURES
CCL will implement measures such as:
•Access control and secure authentication.
•Role management and segregation of duties.
•Encryption and periodic backups.
•Policies for use of technological assets.
•Protocols for use of AI tools (e.g., Microsoft Copilot).
•Mandatory anonymization when applicable.
•Periodic internal audits.
•Mandatory annual training.
All technological tools must be used in accordance with internal protocols.
EIGHTH. DATA TRANSFERS
Any transfer or disclosure of data must:
•Have a legal basis.
•Be formalized through a processing agreement.
•Ensure equivalent security standards.
•Regulate confidentiality and limited use.
NINTH. PREVENTION MODEL
In compliance with Article 49 of Law No. 21,719, CCL adopts a Prevention Model including:
•Appointment of a Data Protection Officer.
•Mapping of processing activities.
•Documented internal protocols.
•Risk matrix.
•Whistleblowing channel.
•Internal disciplinary regime.
•Ongoing supervision and improvement.
TENTH. RESPONSIBILITIES
Board of Directors
•Approval of the policy.
•Allocation of resources (if applicable).
•Supervision of compliance.
Data Protection Officer
•Internal advisory.
•Compliance supervision.
•Handling data subject requests.
•Incident response coordination.
IT Department
•Implementation of technical controls.
•Access management.
•Protection of technological assets.
Employees and Collaborators
•Comply with this policy.
•Maintain confidentiality.
•Report breaches.
•Participate in training.
ELEVENTH. DATA RETENTION
Personal data will be retained only as long as necessary and then:
•Deleted,
•Anonymized, or
•Blocked when applicable.
TWELFTH. REVIEW AND UPDATE
This policy will be reviewed:
•At least once a year.
•When legal changes occur.
•When significant operational changes arise.
THIRTEENTH. EFFECTIVENESS
This policy becomes effective upon approval and will be periodically reviewed or updated as needed.