Personal Data Treatment Policy
In this section you will find all the information that the Industrial University of Santander has made available to the public regarding the Manual of Administrative Procedures for the Treatment of Personal Data.
RESOLUCIÓN
1227 DE 2013
Whereby the Manual de Procedimientos Administrativos para el Tratamiento de Datos Personales (Administrative Procedures Manual for the Processing of Personal Data) is approved.
THE RECTOR OF THE UNIVERSIDAD INDUSTRIAL DE SANTANDER
By virtue of the legal and regulatory powers, and
CONSIDERING:
That the Congreso de la República (Congress of the Republic) enacted Ley Estatutaria 1581 de 2012 (Statutory Law 1581 of 2012), which sets forth general provisions for the protection of personal data.
That Article 2 of the aforementioned law provides that the principles and provisions contained therein shall be applicable to personal data recorded in any database that renders them subject to processing by public or private law entities.
That, by Decreto 1377 de 2013 (Decree 1377 of 2013), the Gobierno Nacional (National Government) regulated Ley 1548 de 2012 (Law 1548 of 2012) and imposed on the entities responsible for the processing of personal data the obligation to issue personal data processing policies, so that such entities may fully comply with them.
That the second paragraph of Artículo 13 of Decreto 1477 de 2013 (Decree 1477 of 2013) provides that políticas de tratamiento de información (information processing policies) must be documented in physical or electronic form, in clear and simple language, and made available to the data subjects.
That the Universidad Industrial de Santander, in compliance with the provisions of Artículo 13 of Decreto 1377 de 2013 (Decree 1377 of 2013) and in strict respect for confidentiality and the right of habeas data of all natural or legal persons who, by virtue of an employment, academic, contractual, commercial, or any other relationship with the University—whether permanent or occasional—provide information, hereby issues the present Manual de Procedimientos Administrativos para el Tratamiento de Datos Personales (Administrative Procedures Manual for the Processing of Personal Data), which contemplates, among other things, the recognition of the right to access, review, modify, update, rectify, or delete the information supplied, and to revoke the authorization for data processing.
That, pursuant to literal m) of Article 30 of the Estatuto General de la Universidad Industrial de Santander (University’s General Statute), it is the Rector’s responsibility to issue the manuals of functions, requirements, and administrative procedures.
RESOLVE:
ARTICLE 1. To approve the Manual de Procedimientos Administrativos para el Tratamiento de Datos Personales of the Universidad Industrial de Santander, the text of which forms an integral part of this Resolution.
ARTICLE 2. To order, through the Secretaría General (General Secretariat), its publication via institutional communication channels and its permanent inclusion on the institutional website through an easily accessible link for all portal users.
ARTICLE 3. To communicate and disseminate it, through the Secretaría General, to all academic and administrative units and dependencies that form part of the Estructura Organizacional Institucional (Institutional Organizational Structure).
PUBLISH, COMMUNICATE, AND COMPLY.
Issued in Bucaramanga on the twenty-second (22nd) day of August, 2013.
RECTOR, ÁLVARO RAMÍREZ GARCÍA
SECRETARIA GENERAL, ADRIANA CASTILLO PICO
MANUAL DE PROCEDIMIENTO ADMINISTRATIVO PARA EL
Tratamiento de Datos Personales
(Administrative Procedures Manual for the Processing of Personal Data)
• ARTICLE 1. Purpose of Personal Data Processing.
The Universidad Industrial de Santander respects the confidentiality and the right to habeas data of all natural or legal persons who, by virtue of an employment, academic, contractual, commercial, or any other relationship with the university—whether permanent or occasional—provide information; granting them the right to access, review, modify, update, rectify, or delete the information supplied and to revoke their authorization for data processing.
The present Manual de Procedimientos Administrativos para el Tratamiento de Datos Personales is subject to the principles governing public administration set forth in Article 29 of the Constitución Política (Political Constitution) of Colombia. Accordingly, those responsible for processing personal data must comply with this manual in an agile, effective, efficient, and timely manner.
• ARTICLE 2. Controller and Processor of Personal Data.
The Universidad Industrial de Santander shall be the controller of personal data processing—acting through all its public servants and any private individuals who, whether by virtue of a contract with the university (regardless of its nature) or in the performance of their duties, access information collected under the terms provided by law and in this manual.
• ARTICLE 3. Rights of the Data Subject whose Personal Data is Subject to Processing by the University.
The Data Subject shall have the following rights:
To know, update, and rectify their personal data before the data controllers and processors. Under this right, they may act, among other things, with respect to partial, inaccurate, incomplete, fragmented data, data that lead to error, or data whose processing is expressly prohibited or has been authorized;
To request proof of the authorization granted to the data controller, except when such authorization is expressly exempted as a requirement for processing, in accordance with the provisions of Article 10 of this law;
To be informed by the data controller or processor, upon request, about the uses made of their personal data;
To file complaints with the Superintendencia de Industria y Comercio (Superintendency of Industry and Commerce) regarding infringements of the provisions of this law and any other regulations that amend, supplement, or complement it;
To revoke authorization and/or request the deletion of the data when the processing does not respect constitutional and legal principles, rights, and guarantees. Revocation and/or deletion shall proceed when the Superintendencia de Industria y Comercio has determined that the controller or processor has engaged in conduct contrary to this law and the Constitution.
To access their personal data free of charge when it has been subject to processing.
• ARTICLE 4. Processing and Use of Personal Data.
The Universidad Industrial de Santander shall establish and maintain, in its information systems and/or any other medium constituting a database, the information it collects from third parties for the purposes set forth in the law and in this manual; undertaking to keep confidential any information classified as confidential in accordance with applicable regulations, its statute, internal regulations, and any contracts and/or agreements it enters into with third parties, in accordance with the principle of university autonomy.
The information collected by the university shall be used to fulfill its institutional purposes and, given its status as an institution of higher education, may be processed either directly or through third parties.
The university may transmit and/or transfer the information subject to processing among its own academic and administrative units when required for the proper delivery of its core functions (teaching, research, and outreach), or to the various administrative or judicial authorities (including, without limitation, tax authorities and bodies responsible for criminal, civil, administrative, disciplinary, and fiscal investigations) that so request it.
• ARTICLE 5. Authorization for the Processing of Personal Data.
All academic and administrative units of the Universidad Industrial de Santander that collect personal data in the exercise of their core functions must obtain the data subject’s prior, express, voluntary, and duly informed authorization to collect, store, use, disseminate, delete, process, compile, exchange, manage, update, and otherwise dispose of the data that have been supplied and incorporated into the University’s institutional information systems and/or any other medium—whether physical or electronic—that constitutes a database.
The authorization referred to herein may be documented in a physical or electronic instrument, data message, Website, or any other format that ensures its later review, or obtained through an appropriate technical or technological mechanism that allows for the expression or capture of consent.
In any event, under Artículo 10 de la Ley 1581 de 2012 (Article 10 of Law 1581 of 2012), the data subject’s authorization shall not be required when the University needs the data in the exercise of its legal functions or by court order.
• ARTICLE 6. Right of Access to the Information Provided.
The Universidad Industrial de Santander shall permit the data subject, upon verifying their identity, and/or any third party appointed as the data subject’s authorized representative, to access—free of charge—the information provided, by written or electronic means, for the purpose of facilitating its update.
The request for access to information may be submitted via written or electronic communication to the academic-administrative unit responsible for processing the information provided.
• ARTICLE 7. Petitions, Complaints and Claims.
The data subject may request the update, rectification, or deletion of the information provided, as well as the revocation of the authorization for data processing, as follows:
The petition, complaint, or claim shall be submitted by the data subject or by a duly constituted representative, in accordance with the information requirements set forth in Artículo 15 de la Ley 1581 de 2012 (Article 15 of Law 1581 of 2012) and Decreto 1377 de 2013 (Decree 1377 of 2013), as well as any regulations that amend, supplement, or replace them, indicating the name of the University’s academic-administrative unit responsible for processing the information.
The petition, complaint, or claim shall be submitted to the Universidad Industrial de Santander via the “Quejas, Reclamos y Sugerencias” (Complaints, Claims, and Suggestions) link on the institutional website: www.uis.edu.co.
The Dirección de Control Interno y Evaluación de Gestión (Internal Control and Management Evaluation Department) of the Universidad Industrial de Santander is the unit responsible for receiving and directing the petitions, complaints, and claims addressed in this manual to the corresponding departments.
• ARTICLE 8. Effective Date.
This manual shall come into effect upon its publication, in accordance with the terms set forth in the Resolution that approves it.