PERSONAL DATA PROCESSING POLICY – LAST TOUR AMERICA S.A.S.
The purpose of this Personal Data Processing Policy (hereinafter the “PTDP”) is to develop and establish the terms and conditions under which LAST TOUR AMERICA S.A.S. (hereinafter “The Tour”), as Data Controller, processes the Personal Data of the Data Controllers. In harmony with the provisions of Article 15 of the Political Constitution of Colombia, Law 1266 of 2008, Law 1581 of 2012, Decree 1377 of 2013 and all those rules that regulate, add, repeal or modify them, this PTDP sets out the corporate policies with which Last Tour treats the Personal Data of the Data Controllers, the purposes of the Processing, the rights of the Data Controllers and the mechanisms available to the Data Controllers to know, update, rectify, delete and in general to assert their rights as Data Controllers of Personal Data.
The Personal Data of the Data Controllers shall be processed with special observance of the principles of legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security and confidentiality.
The Data Subjects, by authorising the Processing of their Personal Data, fully accept the present PTDP and its additions or modifications, which will be informed to them through suitable means, in accordance with the regulations in force.
The information provided by the Data Subjects will be used to perfect the contractual relationship or link that arises with Last Tour. If the Personal Data provided are of a financial, credit or commercial nature, they will be processed in order to carry out transactions arising from the contractual relations generated. In addition, if Cardholders submit information through the website https://bime.org/, Last Tour will use the Information to send cookies to your hard drive, in order to provide a service according to the preferences of the Cardholder.
FIRST: DEFINITIONS.
For the purpose of interpreting the terms of this DWCP, the following shall be observed in the
following rules:
- Terms with initial capital letters shall have the meaning assigned to them.
- Terms denoting the singular also include the plural and vice versa, whenever the context so requires.
- Terms which are not expressly defined shall be understood in the sense attributed to them by technical language, or in their natural sense, according to their general usage.
- References to applicable laws or statutory provisions include all applicable laws or statutory provisions as added, extended, consolidated, modified or replaced from time to time and to any order, regulation, instrument or other provision made thereunder.
- The headings and/or sections included in this Personal Data Processing Policy have been incorporated for convenience and shall not be considered part of this Policy or limit the scope of the terms and provisions of this Policy.
- Any enumeration or relationship of concepts where there is a disjunctive conjunction “or” shall be understood as comprising some or all of the elements of such enumeration or relationship. Likewise, any enumeration or relation of concepts where there is a copulative conjunction “and” must be understood to include each and every one of the elements of such enumeration or relation.
Without prejudice to the other definitions contained in this DWCP, in accordance with the regulations in force, the following definitions shall apply:
- “Authorisation”: prior, express and informed consent of the Data Subject for 10 Music to carry out the Processing of his or her Personal Data, which may be requested through different mechanisms and technical means and may be (i) in writing; (ii) orally; or (iii) by unequivocal conduct.
- “Privacy Notice”: verbal or written communication generated by the Controller, addressed to the Data Subject for the Processing of his/her personal data, by means of which he/she is informed about the existence of the PTDP, how to access the PTDP and the purposes of the Processing that Music will give to the Personal Data, published in the Attention Channels.
- “Database” means an organised collection of Personal Data that is the subject of Processing by 10 Music.
- “Personal Data” means any information linked or capable of being linked to one or more specific or identifiable natural person(s). 10 Music will process the Personal Data as set out in Section Five of this PTDP.
- “Public data” means data that is not semi-private, private or sensitive. Data relating to the marital status of persons, their profession or trade and their status as merchants or public servants, among others, are considered Public Data.
By their nature, Public Data may be contained, inter alia, in public registers, public documents, official gazettes and bulletins and duly executed court judgments that are not subject to confidentiality.
- “Sensitive Data”: data that affect the privacy of the Data Subject or whose improper use may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social organisations, human rights organisations or organisations that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sex life and biometric data.
- “Data Processor”: a natural or legal person, public or private, who, alone or in association with others, carries out the Processing of personal data on behalf of the Controller.
- “Controller”: natural or legal person, public or private, who by himself or in association with others, decides on the Database and/or the Processing of Personal Data, for the purposes of the PTDP, when referring to the Controller, shall refer to 10 Music.
- “Data Subject”: the natural person whose Personal Data is the subject of Processing. The Headline Holders are defined in Section Five of this DWCP.
- “Transfer”: the transfer shall take place when the Controller and/or Processor sends the information or Personal Data to a recipient, which in turn is a Controller and is located inside or outside the country.
- “Transmission”: Processing of Personal Data that involves the communication of Personal Data within or outside the territory of the Republic of Colombia when the purpose of the Processing is carried out by the Processor on behalf of the Controller.
- “Processing”: any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion, to be carried out solely for the purposes set out in this PTDP with the prior Authorisation of the Data Subject.
SECOND: SCOPE OF THE PROCESSING OF PERSONAL DATA AND SENSITIVE DATA.
In the ordinary course of its business and in the performance of its corporate purpose, whether permanently or occasionally, Last Tour will process the Personal Data and Sensitive Data of the Data Subjects and will carry out operations of collection, use, storage, circulation, deletion, Transmission or Transfer of Personal Data and Sensitive Data of the Data Subjects and in general of any third party with whom it has any type of contractual relationship or link of any nature.
The express or unequivocal authorisation of the Data Subjects for the Processing of their Personal Data and/or Sensitive Data implies acceptance for the Processing of their Personal Data, which will be carried out in accordance with the provisions of this PTDP. In any case, this PTDP may NOT be interpreted in any way contrary to the applicable laws and/or the rights that correspond to the Data Subjects.
Likewise, the purposes, measures and procedures established for the Processing of the Personal Data of the Data Controllers are established, as well as the mechanisms available to the Data Controllers to know, update, rectify, delete and, in general, to enforce their rights as holders of Personal Data.
Last Tour, as the party responsible for the processing of Personal Data, will make its best professional effort to maintain under adequate standards of quality, protection and security of information, all Personal Data it receives from Data Subjects, especially Sensitive Data. Likewise, it shall endeavour to ensure that the Personal Data and/or Sensitive Data collected have the necessary technical and legal protection to guarantee their security, integrity, access and confidentiality. In this regard, by authorising the Processing of their Personal Data, the Data Controllers expressly authorise Last Tour to store their Personal Data and/or Sensitive Data in the manner it considers relevant and adequate and to comply with the security required for the protection of Personal Data and Sensitive Data, in accordance with the normal and reasonable standards applicable to the services of issuing and providing tickets for mass transport, public shows, parks and public and private recreation sites and other activities included in its corporate purpose.
THIRD: IDENTIFICATION OF THE CONTROLLER.
Last Tour is a company primarily engaged in the issuance and provision of tickets for mass transit, public entertainment, parks and public and private recreational venues. This PTDP is strictly binding on Last Tour whose information is as follows:
Company name: LAST TOUR AMERICA S.A.S.
N.I.T.: 901.470.694-5
Last Tour can be contacted at:
Ø Address: Calle 78 # 8 – 74. Ofic. 301 de la ciudad de Bogotá, D.C.
Ø Telephone: +57 3175670672
Ø E-mail: pqrs@10music.com
Ø Website: https://bime.org/
FOURTH: PERSON AND AREA RESPONSIBLE FOR DEALING WITH REQUESTS, QUERIES
AND COMPLAINTS.
The area in charge provided by 10 Music for the attention of requests, queries and claims, and in general for Data Subjects to exercise their rights, will be the Customer Service Area, the person in charge will be the head of this area who may be contacted by Data Subjects or their assignees for the attention of their queries, claims, requests for rectification, updating and suppression of their Personal Data, directly in Bogotá, through physical communication at Calle 78 # 8 – 74. Ofic. 301 de la ciudad de Bogotá, D.C. or by express request by e-mail to pqrs@10music.com.
FIFTH: SERVICE CHANNELS.
Last Tour may carry out the operation of collecting the Personal Data of the Data Subject in any of the following service channels:
- Call Center.
- National network of sales outlets.
- Online sales via the website https://bime.org/
- Directly at the administrative headquarters.
These service channels represent the ways in which 10 Music collects Personal Data from Data Subjects (1, 2, 3, and 4 hereinafter referred to as the “Service Channels”).
SIXTH: DATA SUBJECTS AND PERSONAL DATA SUBJECT TO PROCESSING.
Last Tour will process the Personal Data of the following individuals (for all purposes of this PTDP they will be referred to as the Data Subjects):
- Customers – Buyers or promoters.
- Employees – Active or inactive collaborators.
- Former employees.
- Pensioners.
- SENA apprentices.
- Applicants for a job vacancy.
- People in selection processes.
- Family members of employees or former employees, such as their spouse, permanent partner or children.
- Workers on mission.
- Suppliers.
- Contractors.
- Inactive trainees.
- Third parties with a business relationship.
- Representatives of public entities.
- Representatives of the competition.
- Trade allies.
- Partners.
By voluntarily providing their Personal Data and/or Sensitive Data in the manner indicated in this PTDP and in the express authorization, verbally, in writing or through unequivocal conduct, the Data Subjects expressly or unequivocally authorize Last Tour to process their Personal Data and/or Sensitive Data and any other information they provide, in accordance with this PTDP, the law and for the purposes set forth in this PTDP (Section Seven) or any additional purpose authorized by the Data Subjects. In general, Last Tour will be able to collect:
(a) Location data.
Physical location of the Data Subject, such as residence address, home address, address and name of the company where he/she works, among others.
(b) Contact and communication details
Telephone and mobile numbers, as well as email and social media IDs.
(c) Employment data
Information of an employment and academic nature, which allows accrediting the experience and training of the Holder.
(d) Registration data
In the case of browsing on the https://bime.org/ website, certain information is stored automatically, including search queries made, IP address of internet users, system activity, computer faults, browser type, specifications characterising the requests, etc.
(e) Sensitive Data
Last Tour may carry out the Processing of biometric data, such as the fingerprint or image (understood as a figure, total or partial physiognomy of the Data Subject’s body) of the Data Subjects. Sensitive Data, in relation to the Processing that may be carried out by Last Tour, shall be those unique features of Data Subjects that individualise them in relation to other persons. Sensitive Data will be used for the purposes of: (a) identify the Cardholder when making purchases at the points of sale; (b) surveillance and security reasons at the administrative headquarters or points of sale of Last Tour.
Last Tour informs Sensitive Data Subjects that providing sensitive information is merely optional and they are not obliged to provide information related to their Sensitive Data.
The Authorisation of Data Subjects for the Processing of their Personal Data shall be granted by: (a) the Holders, who must prove their identity by the means Music requests them to do so; (b) the Beneficiaries or guardians of the Data Subject, who must prove their capacity as Beneficiaries of the Data Subject; and (c) the representative and/or attorney-in-fact of the Data Subject, subject to proof of representation or power of attorney; and (d) another in favour of or for whom the Data Subject has stipulated.
The Data Subjects who provide their Personal Data or Sensitive Data in any of the Attention Channels, authorise 10 Music to process their Personal Data and/or Sensitive Data. Last Tour may carry out the Processing of:
(i) If they are customers, prospects or business allies, of any nature, in any of the Attention Channels:
- Name.
- Address.
- Landline telephone number.
- Mobile phone number.
- E-mail address.
- Date of birth.
- The preferences registered in Vive Last Tour.
- Fingerprint.
- Image.
(ii) If they are employees, former employees, pensioners, trainees, SENA apprentices, applicants, mission workers, suppliers, contractors, active or inactive collaborators, applicants for a job vacancy, third parties with an employment or commercial relationship, students, trainees, family members of employees or former employees, such as their spouse, permanent partner or children, third parties with an employment or commercial relationship, or business partners, in any of the Service Channels:
- Name.
- Address.
- Landline telephone number.
- Mobile phone number.
- E-mail address.
- Date of birth.
- Professional background.
- Employment background.
- Fingerprint.
- Image.
(iii) In the case of representatives of public entities or representatives of the competition, in any of the Attention Channels:
- Name.
- Address.
- Landline telephone number.
- Mobile phone number.
- E-mail address.
- Date of birth.
- Fingerprint.
- Image.
The Authorisation may be recorded in a physical or electronic document, in any other format that guarantees its subsequent consultation, or by means of a suitable technical or technological mechanism by means of which it may be unequivocally concluded that, in the absence of conduct by the Data Subject, the Personal Data would never have been captured and stored in the Database. Last Tour shall take the necessary measures to maintain appropriate technical or technological records or mechanisms of when and how it obtained authorisation from Data Subjects.
SEVENTH: PURPOSES OF PROCESSING.
The Personal Data and Sensitive Data collected by Last Tour is collected for the general purpose:
(a) to carry out the relevant actions for the development of its corporate purpose in relation to the fulfilment of the purpose of the contract entered into with the Data Subject; (b) compliance with the regulations in force; (c) educational and academic purposes; (d) communicate with Data Subjects for any purpose related to the purposes set forth in this PTDP, whether by means of calls, text messages, e-mails and/or physical mails; (f) sending information about the products or services marketed by Last Tour, as well as news, novelties, publications and own or third party promotions, invitations to events and offering new products and services; (g) send information about own and third party programmes; (h) conduct scientific studies or research for academic or commercial use; (i) either directly or through third parties: consult, carry out administrative procedures, send commercial information, request completion of surveys, collect, store, use, circulate, delete, process, contact, survey, compile, exchange, publish, audit, update and/or dispose of the Personal Data provided by the Data Controllers in order to incorporate them in the different Last Tour Databases; (j) handling requests, complaints or claims.
The specific purposes, depending on the relationship with each Data Subject, for which Last Tour will process the Personal Data of Data Subjects, are:
- To inform Data Subjects about novelties, news, own and/or third party promotions; to specify, analyse and optimise existing and future own and/or third party products and services; to report information on credit risks and control and prevention of money laundering; to carry out activities of filing, updating, storage and processing of information, directly or through third parties contracted for this purpose; to promote and market own and/or third party products and services.
- Identify ways in which Last Tour can better serve you, such as providing you with information about products and services more effectively.
- Processing and administration of transactions as a client or member of Vive Last Tour, also establishing a communication channel in order to inform you of any news regarding the products and services offered, such as cancellation of events, change of dates, change of programme, etc.
- To offer the Data Subjects products and services, to carry out marketing studies, market segmentation and statistics and to know their consumption habits, tastes and preferences in order to offer them those products that are suitable for the Data Subjects; to send them promotions, advertising and discount coupons for products or services, as well as for those products of the companies with which Last Tour has a corporate relationship; and to invite them to participate in contests or sweepstakes and activities.
- Marketing and research.
- Offer you the products you have requested as a customer.
- To provide you with a range of products and services that offers Last Tour.
- To comply with the obligations contracted by Last Tour with the Holders, in relation to the payment of salaries, social benefits and other retributions enshrined in the employment contract.
- Offer corporate welfare programmes and conduct business activities, for the Holder and its beneficiaries, such as children, spouse or permanent partner).
- Send commercial products and services to the address registered at the time of choosing the shipping method.
- Transfer Personal Data or Sensitive Data to third parties with whom there is a data processing contract, or whose contractual purpose requires the transfer of Personal Data.
- Transfer Personal Data to third parties or service providers necessary for Last Tour to carry out its corporate purpose.
- Transfer to third parties that provide services for the operation of Last Tour’s computer systems, to send physical mailings or e-mails or to companies that perform data analysis, to generate marketing strategies, segmentation of demographic groups and other information on Data Subjects that allow them to characterise them demographically according to their “genres of interest”.
- Transfer to third parties who manage, operate or own venues or venues where events are held for which data subjects purchase tickets in order to provide them with promotional material about upcoming events.
- Transfer Personal Data to third parties with which Last Tour has contractual relations and which is necessary for the fulfilment of the contracted object, such as the transfer to the promoter or promoters of the events for which the Holder purchased tickets so that they, as data controllers, process the Personal Data.
- To provide Registrants with Last Tour products and services (including, to process their online purchases), to contact them in the event of a cancellation of events, or a change of scenery, and for marketing purposes.
Last Tour does not verify, nor does it assume the obligation to verify the identity of those who provide their Personal Data or Sensitive Data, nor the validity, sufficiency and authenticity of the Personal Data or Sensitive Data that the Data Subject provides about him/herself, therefore, 10 Music is not liable for any damages of any nature that may be generated by the lack of accuracy, validity, sufficiency or authenticity of the information provided. This includes damages that may arise from impersonation of a third party. This PTDT applies to any processing of Personal Data and/or Sensitive Data collected in any of the Service Channels.
Among the Personal Data collected by Last Tour are those relating to the interests and preferences of the Data Subjects, as well as those relating to the browser used and the devices used to browse the web. In accordance with the purposes set out above, the Personal Data may be made available to the staff in charge of the relevant task within Last Tour.
EIGHTH: RIGHTS OF THE HOLDERS.
The rights of the Data Controllers referred to in this Personal Data Processing Policy are contained in Law 1581 of 2012 and Decree 1377 of 2013. In particular, the rights of Data Subjects as set out in Article 8 of Law 1581 of 2012:
- To know, update and rectify their personal data in relation to Last Tour, as Data Controller or Data Processors.
- Request proof of the authorisation granted to Last Tour, as Data Controller, except when expressly exempted as a requirement for the Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012.
- Be informed by Last Tour, as the Controller or the Processor, upon request, regarding the use it has made of your Personal Data.
- File complaints before the Superintendence of Industry and Commerce for infringements of the provisions of the regulations in force.
- To revoke the Authorisation and/or request the deletion of the Personal Data when the Processing does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the Processing, Last Tour or the Data Processor, incurred in conduct contrary to the law or the Constitution.
- Refrain from answering questions about Sensitive Data. Last Tour is transparent with the Data Subjects and informs them that the provision of Sensitive Data will be optional, as well as responses that deal with data on children and adolescents.
- Access free of charge to your Personal Data processed by Last Tour.
The Data Subjects may, at any time, access the Personal Data stored by Last Tour and the details of the Processing, as well as rectify them in case they are inaccurate or incomplete, and delete them when they consider that they are not required for any of the purposes indicated in this PTDT, when they are being used for unauthorised purposes, or simply oppose the Processing.
NINTH: DATABASE SECURITY.
The security measures in place at Last Tour seek to protect the Personal Data of Data Subjects, in order to prevent their adulteration, loss, use and unauthorised access. To this end, Last Tour diligently implements administrative, legal and technical protection measures that are reasonably within its power. The Data Subjects expressly accept this form of protection and declare that they consider it suitable and sufficient for all purposes.
Similarly, third parties contracted by Last Tour are obliged to adhere to and comply with the information security policies and manuals, as well as the security protocols that Last Tour applies to all its processes.
All Last Tour contracts with third parties (contractors, external consultants, temporary collaborators, etc.) that involve Processing include a confidentiality agreement detailing their commitments for the protection, care, security and preservation of the confidentiality, integrity and privacy of the same.
Last Tour protects Personal Data, in proprietary data format, which can only be read with proprietary tools. In storing the information, Last Tour has taken a number of measures to protect Personal Data from misuse, loss, unauthorised access, modification or disclosure. Personal Data collected online is stored in a Microsoft SQL Server database, a secure data protection centre that cannot be accessed via the Internet.
Last Tour encrypts data sent from the Registrant’s computer to its systems during Internet transactions and from the Registrant’s access through networks.
Last Tour also employs firewalls, intrusion detection systems and virus detection tools to protect Personal Data from access by unauthorised persons or viruses. In addition, Last Tour takes reasonable steps to destroy Personal Data permanently when it is no longer needed. It also imposes strict security and confidentiality requirements on all third parties as to how they store and handle the Databases.
TENTH: ATTENTION OF PETITIONS, CONSULTATIONS AND CLAIMS.
For the filing and attention of your request, consultation or claim, the Data Subject must provide the following information:
- Full name and surname.
- Physical address.
- E-mail.
- Telephone number (landline).
- Mobile number.
- Means to receive a response to your request.
- Reason(s)/fact(s) giving rise to the claim with a brief description of the right you wish to exercise (to know, update, rectify, request proof of the authorisation granted, revoke it, delete, access the information).
- Signature (if applicable) and identification number.
Data Subjects may submit their requests, queries and claims through any of the following channels:
(i) Go from 08:00 to 5:00, Monday to Friday, to the administrative headquarters, where you can present it directly to the area in charge, at the address: Calle 78 # 8 – 74. Ofic. 301.
(ii) By sending a written communication to the following address: Calle 78 # 8 – 74. Ofic. 301 de la ciudad de Bogotá, D.C.
(iii) By phone call to: +57 3175670672
(iv) By e-mail to the following address: pqrs@10music.com
Data Subjects or their successors in title may exercise their rights or submit requests, queries or complaints in accordance with the procedures set out in this Section. The request, query or complaint will be dealt with within a maximum of fifteen (15) working days from the date of receipt. If it is not possible to deal with the consultation within this period, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be dealt with, which in no case may exceed eight (8) working days following the expiry of the first period.
The Data Subject or his or her successors in title who wish to exercise their rights, such as the correction, updating or deletion of their Personal Data that are subject to Processing by Last Tour, may submit their request, in accordance with the procedure set out in this Section. Last Tour shall respond to any request within the maximum period provided by law of fifteen (15) working days, counting from the day following the date of its receipt. When it is not possible to deal with the claim within this period, the interested party will be informed of the reasons for the delay and the date on which the claim will be dealt with, which in no case may exceed eight (8) working days following the expiry of the first period.
For more information on privacy and consumer protection visit: www.sic.gov.co.
If Last Tour totally or partially prevents the Data Subject from exercising his or her right, he or she may appeal to the Delegation for the Protection of Personal Data of the Superintendence of Industry and Commerce.
ELEVENTH: NEW USES.
Last Tour may request authorisation for the use or circulation of the Personal Data of the Data Subjects or other types of information, for purposes other than those expressed in this PTDP, for which it will publish in any public media it deems appropriate according to the case.
ELEVENTH: PERSONAL DATA OF CHILDREN AND ADOLESCENTS.
Last Tour does not collect Information from Users under the age of 18, however, when Personal Data is collected from children and adolescents, the Authorisation of the child’s parents or guardian will be obtained.
TWELFTH: TEMPORALITY.
Last Tour will use, process and store the Personal Data and Sensitive Data collected until it fulfils its purposes, which in any case will not be less than 80 years, and this is the scope of the authorisation granted by the Data Subjects.
THIRTEENTH: MODIFICATIONS.
Without prejudice to constitutional rights and applicable legal and regulatory provisions, in particular those contained in Law 1581 of 2012, and Decree 1377 of 2013 Last Tour may amend this PDWP at any time. Such modifications shall be informed to Data Subjects through any other targeted or untargeted mass dissemination mechanism.
FOURTEENTH: INTELLECTUAL PROPERTY.
Databases, or different types of electronic repositories, are intellectual creations subject to copyright protection. Last Tour is the owner of the Databases it uses, for which it is fully subject to the rules on protection of Personal Data and habeas data contained in Law 1581 of 2012, and Decree 1377 of 2013. Consequently, Last Tour, as the owner of the rights to the Database, is the only one who has the power to authorise the use, reproduction or disposal of the Database to third parties.
FIFTEENTH: VALIDITY.
Last Tour reserves the right to modify this TPPP at any time, which is why we invite you to regularly or periodically consult our website https://bime.org/, where the latest version of this TPPP will be made available to you. However, by virtue of the provisions of article 5 of Decree 1377 of 2013, when substantial changes are made to the PTDP, referring to the identification of the data controller and the purpose of the processing, which affect the content of the authorisation, it will be necessary to communicate such changes to the Data Subject and Last Tour will obtain a new authorisation from the data subject. The data provided will be used for the period necessary to fulfil the uses and purposes described in this Privacy Policy and in the Terms and Conditions of the Platform.
This DWCP is effective as of 22 February 2023.