This document establishes the Personal Data Treatment Policy of INVERSIONES MENDEBAL S.A. In compliance with the provisions of Law 1581 of 2012, partially regulated by Decree 1377 of 2013; this document describes the mechanisms through which the Organization ensures proper handling of the personal data collected in its databases, in order to allow data subjects to exercise the right of Habeas Data.

INVERSIONES MENDEBAL S.A. It states that with this policy, it guarantees the rights of privacy, intimacy, and good reputation in the processing of personal data. Consequently, it will be governed by the principles of legality, purpose, freedom, truthfulness or quality, transparency, access, restricted circulation, security, and confidentiality.
This Personal Data Treatment Policy and the procedures for its protection are directed to all clients, suppliers, contractors, and employees of Inversiones Mendebal S.A. whose data are included in the company’s databases.



INVERSIONES MENDEBAL S.A. It is a private legal entity based in Bogotá, with Tax ID number 860.353.473-5. The contact details are as follows:
Address: Calle 79B # 8 – 11, Bogotá D.C., Colombia Phone number: 7437430 Email: servicioalcliente@mendebal.com



Authorization: Prior, express, and informed consent of the data subject to carry out the processing of personal data. Database: An organized set of personal data that is subject to processing. Personal data: Any information related to or that can be associated with one or more specific or determinable natural persons. Personal data: Information related to an individual person (considered individually). Public data: Information that is not semi-private, private, or sensitive. Among others, data related to the civil status of individuals, their profession or occupation, and their status as a merchant or public servant are considered public data. By their nature, public data can be contained, among other sources, in public records, public documents, official gazettes and bulletins, and judicial rulings that are not subject to confidentiality. Public personal data: Any personal information that is freely and openly accessible to the general public. Private personal data: Any personal information that has restricted access and is generally considered private to the public. Semi-private data: Semi-private data is information that is not intimate, reserved, or public in nature, and whose knowledge or disclosure may be of interest not only to the data subject but also to a certain sector or group of people or to society in general.Sensitive data: Sensitive data refers to information that affects the privacy of the Data Subject or whose misuse can lead to discrimination, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations, or promoting the interests of any political party, or guaranteeing the rights and guarantees of opposition political parties. It also includes data related to health, sexual life, and biometric data, among others, such as static or moving images, fingerprints, photographs, iris scans, voice recognition, facial or palm recognition, etc. Data Processor: A natural or legal person, public or private, who, either alone or in association with others, processes personal data on behalf of the data controller. Data Controller: A natural or legal person, public or private, who, either alone or in association with others, decides on the database and/or the processing of data. Data Subject: A natural person whose personal data is subject to processing. Transfer: Data transfer occurs when the data controller and/or processor of personal data, located in Colombia, sends information or personal data to a recipient, who is also responsible for processing and is located inside or outside the country. Transmission: Processing of personal data that involves the communication of such data within or outside the territory of the Republic of Colombia when it aims to carry out processing by the processor on behalf of the data controller. Processing: Any operation or set of operations on personal data, such as collection, storage, use, circulation, or deletion.



  1. a) Principle of legality in data processing:The collection and, in general, the processing of personal data must adhere to what is established in Law 1581 of 2012, its Regulatory Decree 1377 of 2013, and other provisions that develop the subject matter.b) Principle of purpose: Processing must adhere to a legitimate purpose according to the Constitution and the Law, which must be informed to the Data Subject. c) Principle of freedom: Processing can only be carried out with the prior, express, and informed consent of the Data Subject. Personal data may not be obtained or disclosed without prior authorization, or in the absence of legal or judicial mandate that relieves consent; d) Principle of truthfulness or quality: The information subject to Processing must be truthful, complete, accurate, updated, verifiable and understandable. Partial, incomplete, fragmented, or misleading data processing is prohibited. e) Principle of transparency: In processing, the Data Subject’s right to obtain, at any time and without restrictions, information from the Data Controller or Data Processor regarding the existence of data concerning them must be guaranteed. f) Principle of access and restricted circulation: Processing is subject to the limits derived from the nature of personal data, the provisions of Law 1581 of 2012, its Regulatory Decree 1377 of 2013, and the Constitution. In this sense, processing can only be carried out by persons authorized by the Data Subject and/or by persons provided for in the law. Personal data, except for public information, cannot be available on the Internet or other means of mass dissemination or communication, unless access is technically controllable to provide restricted knowledge only to the Data Subjects or third parties authorized by law. g) Principle of security: The information subject to processing by the Data Controller or Data Processor referred to in this law must be handled with the technical, human, and administrative measures necessary to provide security to the records, preventing their adulteration, loss, consultation, use, or unauthorized or fraudulent access. h) Principle of confidentiality: All individuals involved in the processing of personal data that are not public in nature are obligated to guarantee the confidentiality of the information, even after their relationship with any of the tasks involving processing has ended. They may only provide or communicate personal data when it corresponds to the development of activities authorized by law and within the terms of the law itself.


Database content

INVERSIONES MENDEBAL S.A.’s databases store general information such as full name, identification number and type, gender, and contact details (email, physical address, landline, and mobile phone number). In addition to these, and depending on the nature of the database, INVERSIONES MENDEBAL S.A. may have specific data required for the processing to which the data will be subjected. In the databases of employees and contractors, additional information includes work and academic history, sensitive data required by the nature of the employment relationship (photograph, family group composition, biometric data).
In databases, sensitive information may be stored with prior authorization from the Data Subject, in compliance with the provisions of articles 5 and 7 of Law 1581 of 2012.



The information contained in the databases of INVERSIONES MENDEBAL S.A. is subjected to various forms of processing, such as collection, exchange, updating, processing, reproduction, compilation, storage, use, systematization, and organization, all of them partially or totally in compliance with the purposes established here. The information may be delivered, transmitted, or transferred to public entities, business partners, suppliers, solely for the purpose of fulfilling the purposes of the corresponding database. In any case, the delivery, transmission, or transfer will be made after the necessary commitments are subscribed to safeguard the confidentiality of the information. Personal information, including sensitive information, may be transferred, transmitted, or delivered to third countries, regardless of the level of security of the regulations governing the handling of personal information. In compliance with legal obligations, INVERSIONES MENDEBAL S.A. may provide personal information to judicial or administrative entities.INVERSIONES MENDEBAL S.A. will ensure the correct use of personal data of minors, guaranteeing compliance with applicable legal requirements and ensuring that all processing is previously authorized and justified in the best interest of minors.



The information collected by INVERSIONES MENDEBAL S.A. aims to allow for the proper development of its corporate purpose. Additionally, the necessary information will be stored to comply with legal obligations, mainly in accounting, corporate, and labor matters. Information about current or past clients, suppliers, strategic allies, and employees is stored to facilitate, promote, enable, or maintain labor, civil, and commercial relationships. The information about actors in the operational mission is stored in order to comply with the activities inherent to its corporate purpose.


Rights of Data Subjects

In accordance with Article 8 of Law 1581 of 2012, Data Subjects may: • Know, update, and rectify their personal data against INVERSIONES MENDEBAL S.A. This right can be exercised, among others, against partial, inaccurate, incomplete, fragmented data, data leading to error, or data whose processing is expressly prohibited or has not been authorized. • Request proof of the authorization granted to INVERSIONES MENDEBAL S.A., except when expressly exempted as a requirement for processing, in accordance with Article 10 of this law. • Be informed by INVERSIONES MENDEBAL S.A. or the Data Processor, upon request, regarding the use that has been made of their personal data. • Lodge complaints with the Superintendence of Industry and Commerce for violations of the provisions of this law and other regulations that modify, add, or complement it. • To revoke the authorization and/or request the deletion of the data when the treatment does not respect the principles, rights and constitutional and legal guarantees. The revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that INVERSIONES MENDEBAL S.A. has not been able to provide the information required by the Superintendence of Industry and Commerce. has incurred in conduct contrary to this law and the Constitution. • Access free of charge to your personal data that have been subject to Processing.


Obligations of the Responsible Party

INVERSIONES MENDEBAL S.A. shall: • Guarantee the Holder, at all times, the full and effective exercise of the right of habeas data. • Request and keep, under the conditions provided for in this law, a copy of the respective authorization granted by the Holder. • Duly inform the Data Subject about the purpose of the collection and the rights he/she has by virtue of the authorization granted. • Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, unauthorized or fraudulent use or access. • Ensure that the information provided to the Data Controller is true, complete, accurate, current, verifiable and understandable. • Update the information, communicating in a timely manner to the Data Processor, all developments regarding the data previously provided and take other necessary measures to ensure that the information provided to it is kept up to date. • Rectify the information when it is incorrect and communicate the pertinent to the person in charge. • To provide to the Processor, as the case may be, only data whose Processing is previously authorized in accordance with the provisions of this law. • Demand that the Data Controller, at all times, respect the security and privacy conditions of the Data Subject’s information. • To process the consultations and claims formulated under the terms set forth in this law. • Adopt an internal manual of policies and procedures to ensure adequate compliance with this law and, in particular, for the handling of inquiries and complaints. • Inform the Data Controller when certain information is under discussion by the Data Subject, once the claim has been filed and the respective process has not been completed. • Inform upon request of the Data Subject about the use given to his/her data; • Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information of the Data Holders. • Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce. Person or area responsible Any request, complaint or claim related to the handling of personal data, in application of the provisions of Law 1581 of 2012 and Decree 1377 of 2013, should be sent to: Entity: INVERSIONES MENDEBAL S.A. Address:Calle 79B # 8-11, Bogotá D.C. E-mail: servicioalcliente@mendebal.com Phone: 7437430


Procedures for submitting and responding to inquiries

The owners of personal data contained in the databases of INVERSIONES MENDEBAL S.A., may consult the data and request the provision of the information contained in the terms provided in the applicable legislation. Any request for consultation, correction, update or deletion must be submitted in writing or by e-mail, according to the information contained in this document. Inquiries will be answered within ten (10) business days from the date of receipt of the respective request. When it is not possible to attend the consultation within said term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the consultation will be attended, which in no case may exceed five (5) working days following the expiration of the first term. Procedures for submission and response to inquiries, complaints and claims Claims must be made in writing or by e-mail, according to the information contained in this document, and must contain at least the following information: – Identification of the Holder – Description of the facts giving rise to the claim – Address of the holder – Documentation to be submitted as evidence If the claim is incomplete, the interested party will be required within five (5) days following receipt of the claim to remedy the faults. After two (2) months from the date of the request, if the applicant does not submit the required information, it will be understood that the claim has been abandoned. In the event that the person who receives the claim is not competent to resolve it, he/she will transfer it to the corresponding person within a maximum term of two (2) business days and will inform the interested party of the situation. The maximum term to address the claim shall be fifteen (15) business days from the day following the date of its receipt. When it is not possible to attend the claim within said term, the interested party will be informed of the reasons for the delay and the date on which the claim will be attended, which in no case may exceed eight (8) working days following the expiration of the first term. Validity and Updating of the Database The Policy for the Treatment of Personal Information of INVERSIONES MENDEBAL S.A. is published on the company’s website and reserves the right to modify it, under the terms and with the limitations provided by law. The databases managed by INVERSIONES MENDEBAL S.A. will be kept indefinitely, as long as it develops its purpose, and as long as it is necessary to ensure compliance with legal obligations, particularly labor and accounting, but the data may be deleted at any time at the request of its owner, as long as this request does not contravene a legal obligation or an obligation contained in a contract between the owner and the company. INVERSIONES MENDEBAL S.A. and the Holder.

Estamos para servirte

Nuestros asesores están listos para atenderte