1. Purpose and scope
150 Por Ciento S.A.S. (hereinafter 150%) adopts this policy to guarantee the right of habeas data of all persons whose personal data it processes. It applies to all physical and digital databases of 150% and is mandatory for its directors, employees, contractors, suppliers and for third parties that process data on behalf of 150%.
This policy is the governing document on personal data protection. The other documents develop its operational application and are listed in section 18.
2. Legal framework
Article 15 of the Political Constitution; Statutory Law 1581 of 2012; Decree 1074 of 2015, chapters 25 and 26 of title 2, part 2, book 2, which compile Decrees 1377 of 2013 and 886 of 2014; Law 1266 of 2008 where applicable; Title V of the Sole Circular of the Superintendence of Industry and Commerce, and that entity’s Guide for the implementation of the principle of accountability.
3. Identification of the data controller
| Item | Information |
|---|---|
| Company name | 150 Por Ciento S.A.S. |
| Tax ID (NIT) | 900.901.834-7 |
| Correspondence address | Carrera 7 # 156-10, piso 17, oficina 1707, Bogotá D.C., Colombia |
| Email for data subjects | [email protected] |
| Phone | +57 312 464 8693 |
| Filing of communications | Carrera 7 No. 156-10, piso 17, oficina 1707, Bogotá D.C., Colombia |
| Channel service hours | 24/7 |
| Area responsible for handling requests | Personal Data Protection Officer |
150% operates entirely remotely. The address indicated is an address for correspondence and the filing of communications; it is not an operating site or an in-person service point.
4. Definitions
For the interpretation of this policy, the definitions of article 3 of Law 1581 of 2012 and of Decree 1074 of 2015 are adopted, in particular: authorization, privacy notice, database, personal data, public data, semi-private data, private data, sensitive data, data processor, data controller, data subject, processing, transfer and transmission.
Terms specific to the management system are defined in the organization’s glossary.
5. Principles
In all processing, 150% applies the principles of legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security, confidentiality and accountability. No data is collected without a defined purpose communicated to the data subject.
6. Processing carried out by the organization
150% carries out the following operations on personal data: collection, storage, use, consultation, updating, circulation, transmission to processors, transfer when permitted by law, anonymization, retention and deletion.
Processing is carried out by digital means, on contracted cloud services. 150% does not have its own processing infrastructure.
7. Purposes by group of data subjects
| Group of data subjects | Data processed | Purposes |
|---|---|---|
| Clients and client contacts | Identification, contact details, job title, billing data. | Perform contracts, invoice, provide support, manage accounts receivable, measure satisfaction and, with authorization, send commercial information. |
| Users of the organization’s own solutions | Identification, credentials, network address, usage logs. | Create and manage accounts, authenticate, provide the service, ensure security and prevent fraud, provide support and improve the service with aggregated or anonymized data. |
| Sales prospects | Identification, contact details, company. | Send proposals, event invitations and commercial content. |
| Employees, interns and former employees | Identification, contact details, employment, social security and banking data; sensitive data when required by law. | Manage the employment relationship, payroll, social security, occupational health and safety and well-being; comply with legal obligations; issue certificates. |
| Candidates | Résumé, education, experience, references. | Conduct selection processes and verify references. |
| Suppliers and contractors | Identification, contact details, tax and banking data. | Select, hire, pay and evaluate; comply with risk prevention systems where applicable. |
8. Processing of client data as a data processor
In the services it provides to its clients, 150% generally acts as the processor of the personal data that those clients upload or manage in the solutions on which the service is provided. This applies throughout the term of the service, regardless of the activity being carried out at any given time. In such cases, 150%:
- Processes the data only in accordance with the documented instructions of the client, who is the controller.
- Does not use the data for its own purposes.
- Formalizes the relationship through a data transmission agreement or a data protection clause.
- Applies the agreed security measures.
- Returns or deletes the data upon termination of the contract, as agreed.
- Forwards to the client any requests from data subjects it receives regarding that data.
9. Rights of data subjects
In accordance with article 8 of Law 1581 of 2012, the data subject has the right to:
- Know, update and rectify their personal data.
- Request proof of the authorization granted, except when it is not required.
- Be informed, upon request, of the use that has been made of their data.
- File complaints with the Superintendence of Industry and Commerce, once the inquiry or claim procedure before 150% has been exhausted.
- Revoke the authorization and request the deletion of the data, unless there is a legal or contractual duty to retain it.
- Access their data free of charge, at least once every calendar month and whenever this policy changes substantially.
These rights may be exercised by the data subject, their successors in title, their representative or attorney-in-fact, and anyone who has made a stipulation in favor of another. The rights of children and adolescents are exercised through their legal representatives.
10. Authorization
150% requests the data subject’s authorization no later than at the time of collection, through a means that allows subsequent consultation: written document, electronic means, recorded oral form or unequivocal conduct. Proof of each authorization granted is retained.
Authorization is not required in the cases of article 10 of Law 1581 of 2012: information required by a public or administrative entity in the exercise of its legal functions or by court order; data of a public nature; cases of medical or health emergency; processing authorized by law for historical, statistical or scientific purposes, and data related to the Civil Registry of Persons.
11. Inquiries and claims
Requests may be submitted through any of the channels in section 3. The detailed procedure is set out in the procedure for handling inquiries and claims.
11.1 Inquiries
Inquiries are answered within a maximum of ten (10) business days from the date of receipt. When it is not possible to answer within that period, the requester is informed of the reason for the delay and the date on which it will be answered, which shall not exceed five business days following the expiration of the first period.
11.2 Claims
Claims are admissible when the data subject considers that their information should be corrected, updated or deleted, when they revoke the authorization or when they notice an alleged breach. The claim must contain the identification of the data subject, a description of the facts, the notification address and any documents they wish to submit.
If the claim is incomplete, the requester is asked within five business days following its receipt to correct the deficiencies. If two months elapse from the request without the information being submitted, the claim is deemed to have been withdrawn.
Once the complete claim has been received, a “claim in process” notation and the reason for it are added to the database within no more than two business days, until the claim is decided.
The maximum period to resolve the claim is fifteen business days from the day following its complete receipt. When it is not possible to resolve it within that period, the requester is informed of the reason and the date on which it will be resolved, which shall not exceed eight business days following the expiration of the first period.
11.3 Inadmissibility
The request for deletion and the revocation of the authorization are not admissible when the data subject has a legal or contractual duty to remain in the database.
12. Sensitive data
150% only processes sensitive data when the data subject explicitly authorizes it, except in cases where the law does not require authorization. When requesting such data, it informs the data subject which data are sensitive, their purpose and that they are not obliged to provide them. No activity is conditioned on the provision of sensitive data.
The applicable controls are set out in the protocol for sensitive data and data of children and adolescents.
13. Data of children and adolescents
150% only processes data of children and adolescents when the processing responds to and respects their best interests and ensures respect for their fundamental rights. Authorization is granted by their legal representative, after the minor has exercised their right to be heard, assessed according to their maturity, autonomy and ability to understand the matter.
14. International transfers and transmissions
150% only transfers personal data to countries that offer an adequate level of protection according to the standards of the Superintendence of Industry and Commerce, unless one of the exceptions of article 26 of Law 1581 of 2012 applies or a declaration of conformity is obtained from that entity. Transmissions to processors located outside Colombia are supported by a data transmission agreement or by the data subject’s authorization.
The identified flows and their handling are set out in the procedure for international transfers and transmissions.
15. Information security
150% adopts technical, human and administrative measures to secure records and prevent their alteration, loss, consultation, use or unauthorized or fraudulent access. It requires the same conditions from the processors it contracts with.
These measures are those of the information security management system, whose framework is set out in the general information security policy and in the information security management system manual.
16. Retention and deletion
Personal data is retained only for as long as necessary to fulfill the purpose that justified its processing and the applicable legal or contractual duties. Once that period has ended, the data is securely deleted or anonymized, in accordance with the procedure for the retention and disposal of personal data.
17. Responsible area
The Personal Data Protection Officer, appointed by a current record of appointment, coordinates compliance with this policy and the handling of data subjects’ requests. Their appointment is formalized in accordance with the record of appointment of the Personal Data Protection Officer.
18. Documents that develop this policy
| Document | What it develops |
|---|---|
| Comprehensive personal data management program | The accountability framework, the database inventory and the annual plan. |
| Handling of data subjects’ inquiries and claims | The procedure and time limits for each type of request. |
| International data transfers and transmissions | The flows abroad and the mechanism that legitimizes them. |
| Registration in the National Database Registry and reports to the authority | The registration of databases and periodic reports. |
| Retention and disposal of personal data | Retention periods and disposal methods. |
| Protocol for sensitive data and data of children and adolescents | The enhanced controls for these categories. |
| Authorization forms and mechanisms | How the data subject’s authorization is obtained and retained. |
| Privacy notice | The communication to the data subject at the time of collection. |
19. Publication, effective date and amendments
This policy is published at https://150porciento.com/es/politica-privacidad/ and may be requested at the correspondence address indicated in section 3. It is effective from its publication and is reviewed at least once a year.
Substantial changes are communicated to data subjects before they are implemented, by email or through the website, and a new authorization is requested when the purpose of the processing changes. The databases remain in force for as long as the purposes described in section 7 remain.
Annex A. Mapping to the current version of ISO 27001
Mapping between the sections of this policy and the controls in Annex A of the current version of ISO/IEC 27001. This is the only section where specific controls are cited.
| Section | Topic | Control addressed |
|---|---|---|
| 2 | Legal framework | 5.31 |
| 5 to 7 | Principles, processing and purposes | 5.34 |
| 8 | Processing as a data processor | 5.34, 5.20 |
| 9 to 11 | Rights, authorization, inquiries and claims | 5.34 |
| 12 and 13 | Sensitive data and data of minors | 5.34 |
| 14 | International transfers and transmissions | 5.34, 5.14 |
| 15 | Information security | 5.34, 5.1 |
| 16 | Retention and deletion | 5.33, 8.10 |
Preparation, review and approval record
| Action | Name | Position | Date |
|---|---|---|---|
| Prepared by | JOSE EFREY RODRIGUEZ | Information Security Representative | 2026-09-21 |
| Reviewed by | CAMILO QUEVEDO | Personal Data Protection Officer | 2026-09-21 |
| Approved by | VALERIO GASPARE TEDESCO LUCENTINI | General Management | 2026-09-21 |
Change log
| Version | Date | Description of change | Responsible |
|---|---|---|---|
Legal notice
The information contained in this document is the property of 150 Por Ciento S.A.S. No part of this document may be reproduced, stored or transmitted in any manner or by any means, whether electronic, mechanical, optical, magnetic recording or photocopying, nor disseminated, without the prior written consent of 150 Por Ciento S.A.S. Any personal information this document may contain will be processed and protected in accordance with the personal data processing policy of 150 Por Ciento S.A.S., available at https://150porciento.com/es/politica-privacidad/.