HABEAS DATA POLICY

SHAPEWEAR LAND, a legally established company, has adopted this privacy policy for the processing of personal data related to the collection, storage, use, circulation, and deletion of such data. Their commitment is to safeguard privacy, intimacy, and reputation, adhering to principles such as legality, purpose, freedom, truthfulness, transparency, restricted access, security, and confidentiality.

Anyone who provides SHAPEWEAR LAND with personal information during contractual, commercial, or employment-related activities -whether permanent or occasional- has the right to know, update, and rectify that information.

Additionally, individuals accessing the website 1 for various purposes, such as gathering ideas, comparing information, or understanding product features and value propositions, can also manage their personal data.

IDENTIFICATION OF THE DATA CONTROLLER AND PROCESSOR

  • Name of the Data Controller and Processor: SHAPEWEAR LAND, a legally established company in accordance with current regulations.
  • Address: SHAPEWEAR LAND is located at 1624 Airline Dr. STE 100, Houston, TX 77009.
  • Email: You can reach SHAPEWEAR LAND at info@shapewearland.com.
  • Phone: For WhatsApp inquiries, contact +1 832-544-7063, and for general inquiries, call +1 346-256-4241.


I. SCOPE OF APPLICATION

This policy applies to personal data registered in any SHAPEWEAR LAND database where the data subject is a natural person.

II. DEFINITIONS

For the purposes of this policy and in accordance with current regulations on personal data protection, the following definitions apply:

  •  Anonymity: The quality or condition of a work being anonymous.
  •  Authorization: The prior, express, and informed consent of the Data Subject for the processing of personal data.
  • Privacy Notice: Verbal or written communication generated by the Data Controller, directed at the Data Subject regarding the processing of their personal data. It informs them about the applicable information processing policies, how to access them, and the purposes of the intended data processing.
  • Database: An organized collection of personal data subject to processing.
  • Personal Data: Any information linked to or associated with one or more specific or determinable natural persons.
  • Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among other things, information related to a person’s marital status, profession, occupation, or public servant status. By nature, public data can be found in public records, official documents, gazettes, bulletins, and legally enforceable court judgments that are not subject to confidentiality.
  • Private Data: Data that is inherently intimate or confidential and is relevant only to the Data Subject.
  • Sensitive Data: Sensitive data refers to information that affects the Data Subject’s privacy or whose misuse could lead to discrimination. Examples include data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions or human rights organizations, promotion of political party interests, or guaranteeing the rights and guarantees of opposition political parties. Sensitive data also encompasses health-related information, sexual life details, and biometric data.
  • Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.
  • User: Anyone who accesses the website. Users can leave messages with their data if they require services from SHAPEWEAR LAND or need more information.


III. PRINCIPLES

To ensure the protection of personal data, SHAPEWEAR LAND will harmoniously and comprehensively apply the following principles in the processing, transfer, and transmission of personal data:

  • Legality Principle: Data processing is a regulated activity that must comply with current and applicable legal provisions.
  • Purpose Principle: The purpose of processing personal data by SHAPEWEAR LAND or any other entity must be communicated to the respective data subject.
  • Freedom Principle: Personal data processing requires prior, express, and informed consent from the Data Subject. Data cannot be obtained or disclosed without authorization, except when legally, statutorily, or judicially mandated.
  • Accuracy or Quality Principle: Information subject to personal data processing must be truthful, complete, accurate, up-to-date, verifiable, and comprehensible. Processing partial, incomplete, fragmented, or misleading data is prohibited. Transparency Principle: In the processing of personal data, SHAPEWEAR LAND guarantees the Data Subject’s right to obtain information about the existence of any type of personal information or data related to them at any time and without restrictions.
  • Access and Restricted Circulation Principle: The processing of personal data is subject to limits derived from their nature and legal provisions. Consequently, data processing can only be carried out by individuals authorized by the Data Subject and/or those specified by law. Personal data, except for publicly available information, should not be accessible on the internet or other mass communication channels unless access is technically controlled to provide restricted knowledge only to Data Subjects or third parties authorized by law. For these purposes, SHAPEWEAR LAND’s obligation is one of means.
  • Security Principle: Personal data processed by SHAPEWEAR LAND must be handled with technical, human, and administrative measures necessary to ensure the security of records, preventing their alteration, loss, unauthorized access, or fraudulent use.
  • Confidentiality Principle: All individuals at SHAPEWEAR LAND who manage, update, or have access to any type of information in databases are obligated to maintain the confidentiality of that information. They must strictly refrain from disclosing it to third parties, except when expressly authorized by data protection laws. This obligation persists even after their relationship with any data processing tasks has ended.

According to the applicable regulations on data protection, the following are the rights of data subjects regarding their personal data held by SHAPEWEAR LAND:

  • Access, Knowledge, Update, and Rectification: Data subjects have the right to access, know, update, and rectify their personal data held by SHAPEWEAR LAND as the data controller. This right applies to partial, inaccurate, incomplete, fragmented, or misleading data, as well as data whose processing is expressly prohibited or unauthorized.
  • Request Proof of Authorization: Data subjects can request proof of the authorization granted to SHAPEWEAR LAND for data processing, using any valid means, except when authorization is unnecessary.
  • Information Regarding Data Use: Upon request, SHAPEWEAR LAND must inform data subjects about how their personal data has been used.
  • Revocation and Data Deletion: Data subjects can revoke authorization and request the deletion of their data if the processing violates constitutional and legal principles, rights, and guarantees.
  • Right to Access Personal Data
  • Data subjects have the right to access their personal data that has been processed, at least once per calendar month and whenever substantial modifications to this policy prompt new inquiries.

These rights can be exercised by:

  • The Data Subject: The individual must sufficiently prove their identity through various means provided by SHAPEWEAR LAND.
  • Heirs of the Data Subject: Heirs must demonstrate their status as such.
  • The Representative and/or Legal Agent of the Data Subject: This requires proof of representation or authorization.

V. RESPONSIBILITIES OF THE COMPANY AS DATA CONTROLLER AND PROCESSOR OF PERSONAL DATA

SHAPEWEAR LAND recognizes that individuals hold ownership of their personal data, and therefore, they have exclusive decision-making authority over it. Consequently, SHAPEWEAR LAND will use personal data only for the purposes explicitly authorized by the data subject or as required by applicable regulations.
In the processing and protection of personal data, SHAPEWEAR LAND has the following duties, in addition to any others stipulated by relevant provisions:

DUTIES AS DATA CONTROLLER:

(i) Request and Retain Authorization: SHAPEWEAR LAND must request and retain a copy of the authorization granted by the data subject, following the conditions outlined in this data protection policy.
(ii) Clear and Sufficient Information: SHAPEWEAR LAND must inform the data subject clearly and sufficiently about the purpose of data collection and the rights granted by the authorization.
(iii) Provide Information Upon Request: SHAPEWEAR LAND must inform the data subject about the use of their personal data upon request.
(iv) Process inquiries and complaints in accordance with the terms outlined in this policy.
(v) Ensure that the principles of accuracy, quality, security, and confidentiality are maintained as specified in the following policy.
(vi) Safeguard information under the necessary security conditions to prevent its alteration, loss, unauthorized access, or fraudulent use.
(vii) Update information when necessary.
(viii) Rectify personal data when applicable.

DUTIES WHEN ACTING AS A DATA PROCESSOR:

If you process data on behalf of another entity or organization (the Data Controller), you must fulfill the following duties:

  • Verify Authorization: Ensure that the Data Controller is authorized to provide the personal data that you will process as the Data Processor.
  • Guarantee Data Subject Rights: Always guarantee the full and effective exercise of the data subject’s right to habeas data.
  • Secure Information: Safeguard the information under necessary security conditions to prevent alteration, loss, unauthorized access, or fraudulent use.
  • Timely Data Management: Promptly carry out data updates, rectifications, or deletions.
  • Update Reported Information: Update the information reported by Data Controllers within five (5) business days from receipt.
  • Handle Queries and Complaints: Process inquiries and complaints from data subjects according to the terms outlined in the existing policy.
  • Record “Claim in Process”: Register the “claim in process” label in the database as specified in the current policy.

AUTHORIZATION AND CONSENT OF THE DATA SUBJECT SHAPEWEARLAND

Requires the free, prior, express, and informed consent of the data subject for the processing of their personal data, except in cases expressly authorized by law, namely:
• Information required by a public or administrative entity in the exercise of its legal functions or by court order.
• Publicly available data.

METHODS FOR GRANTING AUTHORIZATION

SHAPEWEAR LAND will obtain authorization through various means, including physical documents, electronic communication, data messages, the internet, websites, or any other format that allows obtaining consent through unequivocal actions. These actions should clearly indicate that if consent had not been given by the data subject or the authorized person, the data would not have been stored or captured in the database.

SHAPEWEAR LAND will request authorization from the data subject prior to processing their personal data.

PROOF OF AUTHORIZATION

SHAPEWEAR LAND will retain proof of authorization granted by data subjects for the processing of their personal data. To achieve this, SHAPEWEAR LAND will use available mechanisms within its reach and take necessary actions to maintain records of the manner and date of obtaining such authorization. Consequently, SHAPEWEAR LAND may establish physical files or electronic repositories directly or through third parties contracted for this purpose.

REVOCATION OF AUTHORIZATION

Data subjects have the right to revoke the authorization granted to SHAPEWEAR LAND for the processing of their personal data at any time or request the deletion of their data, provided it is not prevented by legal or contractual provisions. SHAPEWEAR LAND will establish simple and free mechanisms that allow data subjects to revoke their authorization or request the deletion of their personal data, at least through the same means by which it was granted.

In this regard, it should be noted that the revocation of consent can be expressed in two ways:

  • Total Revocation: The data subject may revoke consent entirely for the authorized purposes. In such cases, SHAPEWEAR LAND must cease all data processing activities related to those purposes.
  • Partial Revocation: Alternatively, the revocation can be partial, affecting only specific types of processing. For instance, if the data subject revokes consent for advertising purposes, SHAPEWEAR LAND must cease processing activities related to advertising. However, SHAPEWEAR LAND may continue processing personal data for other purposes for which the data subject has not revoked consent.

SHAPEWEAR LAND may use personal data for the following purposes:

  • To execute the existing contractual relationship with its customers, suppliers, and employees, including the payment of contractual obligations.
  • To provide the services and/or products required by its users.
  • To inform about new products or services and/or changes to them.
  • To evaluate the quality of the service.
  • To conduct internal studies on consumption habits.
  • To send commercial, advertising, or promotional information about products and/or services, events, and/or promotions, whether commercial or otherwise, to physical addresses, email addresses, cell phones, or mobile devices via text messages (SMS and/or MMS) or through any other analog and/or digital communication medium, whether existing or to be created, with the aim of promoting, inviting, directing, executing, informing, and generally carrying out commercial or advertising campaigns, promotions, or contests conducted by SHAPEWEAR LAND and/or third parties.

PRIVACY NOTICE

The Privacy Notice is the physical, electronic, or any other format document made available to the data subject to inform them about the processing of their personal data. Through this document, the data subject is informed about the existence of SHAPEWEAR LAND's information processing policies and their applicability, how to access them, and the characteristics of the intended processing of personal data.

The Privacy Notice must contain at least the following information:

  • The identity, address, and contact details of the data controller
  • The type of processing to which the data will be subjected and the purpose of such processing.
  • The rights of the data subject.
  • The general mechanisms provided by the data controller for the data subject to become aware of the information processing policy and any substantial changes made to it. In all cases, it must inform the data subject how to access or consult the information processing policy.
  • The voluntary nature of the response to questions about sensitive data.

GUARANTEES OF THE RIGHT OF ACCESS

To guarantee the right of access for the data subject, SHAPEWEAR LAND, in cases where the data subject registers on the platform, will provide the respective personal data in a detailed and thorough manner, free of charge or any cost, after verifying their identity, legitimacy, or the representation of their representative.

This will be done through all types of means, including electronic means that allow the data subject direct access to them. Such access must be offered without any limitation and should enable the data subject to view and update their information online.

TEMPORAL LIMITATIONS ON THE PROCESSING OF PERSONAL DATA
SHAPEWEAR LAND may only collect, store, use, or circulate personal data for as long as it is reasonable and necessary, in accordance with the purposes that justified the processing, and in compliance with applicable provisions regarding the matter, as well as administrative, accounting, fiscal, legal, and historical aspects of the information. Once the purpose(s) of the processing have been fulfilled, and without prejudice to legal norms that stipulate otherwise, the personal data in its possession will be deleted. However, personal data must be retained when required for the fulfillment of a legal or contractual obligation.

CLAIMS

The data subject or their successors who believe that the information contained in a database should be corrected, updated, or deleted, or who notice an alleged breach of any of the duties contained in the law, may file a claim with SHAPEWEAR LAND, as appropriate, which will be processed under the following rules:

  • The claim by the data subject must be submitted through a request addressed to SHAPEWEAR LAND, as appropriate, from Monday to Friday, 8:00 a.m. to 5:00 p.m., via email at info@shapewearland.com, by calling the SHAPEWEAR GROUP COLOMBIA S.A.S. phone lines at +1 832 544 7063 (WhatsApp) and +1 346 256 4241, or by submitting it to the following address corresponding to our office at 1624 Airline Dr. STE 100 Houston, TX 77009, or to any physical address of the respective business establishments. The request must include the identification of the data subject, a description of the facts giving rise to the claim, the address, and any documents that the data subject wishes to provide. If the claim is incomplete, the interested party will be required to correct the deficiencies within five (5) days following the receipt of the claim. If two (2) months pass from the date of the request without the claimant providing the required information, it will be understood that they have withdrawn the claim.
  • If the recipient of the claim is not competent to resolve it, they will forward it to the appropriate person within a maximum of two (2) business days and inform the interested party of the situation.
  • Once the complete claim is received, it will be labeled as "claim in process" along with the reason for the claim, within no more than two (2) business days. This label will be maintained until the claim is resolved.
  • The maximum period for addressing the claim will be fifteen (15) business days from the day following its receipt. If it is not possible to address the claim within this period, the interested party will be informed of the reasons for the delay and the date on which the claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first period.


REQUEST FOR DATA DELETION

The data subject has the right to request SHAPEWEAR LAND to delete (erase) their data in any of the following events:

  • They believe that the data is not being processed in accordance with the principles, duties, and obligations provided for in the current regulations.
  • The data is no longer necessary or relevant for the purpose for which it was collected.
  • The period necessary for fulfilling the purposes for which the data was collected has been exceeded.

This deletion implies the total or partial elimination of personal information as requested by the data subject in the records, files, databases, or processing carried out by SHAPEWEAR LAND. However, this right of the data subject is not absolute, and consequently, SHAPEWEAR LAND may deny the exercise of this right when:

  • The data subject has a legal or contractual duty to remain in the database.
  • The deletion of the data would hinder judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes, or the imposition of administrative sanctions.


EFFECTIVE DATE

This Personal Data Policy was created on the twenty-eighth (28th) of January, two thousand twenty-three (2023). Any changes to this policy will be communicated via the email address: info@shapewearland.com.