Protection of personal data
Index
Target
In AMBACAR we are committed to the protection of the personal data of our customers, employees, suppliers and any other person who gives their consent to the processing of their personal data. This policy establishes the principles and guidelines for the treatment of personal data, in order to ensure their access, protection and decision within the framework of the principles of privacy, confidentiality, loyalty, proactive responsibility, integrity, among others. All this in order to comply with applicable laws and regulations and guarantee the rights of the holders of personal data.
Scope
Definitions
- Personal data: Any information related to an identified or identifiable natural person.
- Treatment: The processing of personal data refers to any operation or set of operations performed on personal data, whether automated or manual, such as collection, recording, organization, structuring, storage, adaptation, consultation, use, disclosure, communication, modification, extraction, blocking, deletion or destruction, other actions related to those specified in this document, among others. The processing of personal data will be carried out in a fair, lawful and transparent manner.
- Purposes: Without limiting itself, AMBACAR will have among other purposes for the processing of personal data: process and manage vehicle purchase requests; perform credit analysis and financial evaluation; facilitate the delivery of products and services; administer and maintain the business relationship through communication of promotions, offers, advertising, and other company activities; provide technical support and customer service; send notifications and communications about commercial transactions; personalize the customer experience; manage and maintain accounting and financial records; conduct market research and statistical analysis; comply with legal and regulatory obligations; conduct satisfaction and feedback surveys; develop new products and services; administer loyalty and discount programs; process and manage job applications; facilitate internal and external communication within the company; manage logistics and the supply chain; evaluate supplier and employee performance; maintain security and surveillance at facilities; perform extrajudicial and/or judicial collection management directly or through third parties; transfer data to enable suppliers to provide related services for customer vehicles; transfer data to fulfill fiduciary assignments; perform risk analysis and financial security; perform marketing and promotional activities; issue invoices and manage financial transactions; record employee attendance and schedules; administer benefits and wellness programs; facilitate scheduling of appointments at company facilities; facilitate the scheduling of appointments in the company's offices; facilitate the management of the company's employees' work and personal information; facilitate the management of the company's employees' work and personal information; facilitate the management of the company's employees' work and personal information; and manage the company's business and personal information; facilitating the scheduling of appointments in specialized workshops for preventive and corrective maintenance; facilitating, directly or through third parties, satellite tracking of vehicles; performing internal and external audits; complying with audit and oversight requirements; managing claims and dispute resolution; conducting performance evaluations and training; implementing information security measures; maintaining historical records and legal documentation.
- Data owner: Natural person to whom the personal data belongs.
- Responsible for the treatment: Person or entity that decides on the processing of personal data.
- Data Processor: A person who processes personal data on behalf of and under the responsibility of the controller.
- Personal data deletion: in the context of AMBACAR refers to the deletion, deactivation or suspension of a data subject's personal data, rather than its definitive erasure, with the purpose of complying primarily with legitimate and regulatory purposes. This action may include rendering the personal data unreadable or unrecognizable. This action also involves discontinuing access to and processing of data when it is no longer needed for its original purpose, when the consent of the data subject is withdrawn, or if unlawful processing is detected, thus ensuring compliance with applicable privacy and data protection regulations.
- Treatment delegate: Person designated by AMBACAR to monitor and ensure compliance with data protection provisions. The data protection officer acts as a point of contact for queries and requests related to the processing of personal data.
Treatment Principles
AMBACAR is governed by the principles set forth in Article 10 of the LOPDP for the processing of personal data:
- Legality: The processing of personal data must be carried out in accordance with the law and the legal provisions in force.
- Loyalty: The processing of personal data must be based on good faith and meet the reasonable expectations of the data subject.
- Transparency: The holder must be clearly, previously and expressly informed about the purpose of the processing and his/her rights.
- Purpose: Personal data may only be processed for the specific purposes for which they were collected, and may not be used for incompatible purposes.
- Data ownership and data minimization: Personal data must be adequate, relevant and not excessive in relation to the purpose for which it was collected.
- Proportionality of treatment: The processing of personal data must be appropriate and necessary to fulfill the stated purpose.
- Confidentiality: Security measures must be implemented to ensure the confidentiality of personal data and prevent unauthorized access.
- Conservation: Personal data must be kept for the time necessary to fulfill the purpose of the processing and in accordance with current legislation.
- Personal data security: Technical and organizational measures must be taken to protect personal data against unauthorized access, loss, alteration or disclosure.
- Proactive and demonstrated responsibility: Data controllers and processors must demonstrate their compliance with the LOPD and adopt a proactive attitude in the protection of personal data.
- Application favorable to the holder: The provisions and measures adopted in the field of data protection must be favorable to the data subject and guarantee the effective exercise of his or her rights.
Managers
In AMBACAR, we will designate as persons in charge of the processing of personal data the heads or persons responsible for each area, such as Human Resources, Suppliers, Accounting, Marketing, Commercial, Systems, Collections, Workshops, After-sales, among others. These persons in charge will be responsible for complying with the principles and security measures established in this data protection policy.
Each person in charge will have to sign an appointment in which their responsibilities regarding personal data protection are established. In addition, confidentiality and data protection agreements will be signed, committing to maintain the privacy and security of the personal data under their responsibility.
These officers will play a key role in safeguarding the privacy of the personal data of employees, customers, suppliers and other stakeholders. Their performance will be key to ensure compliance with the data protection policy and guarantee the effective exercise of the rights of data subjects.
The Technology Department, in coordination with the Data Protection Delegate, will provide the necessary support to those in charge of implementing the technical and organizational measures established in this policy, as well as to ensure compliance with current data protection regulations.
Data protection by design and data protection by default
Safety measures
Video Surveillance Policies
By maintaining video surveillance systems in several of our facilities, we commit to comply with applicable laws and regulations, limiting the capture and storage of images to the areas and periods necessary to ensure the safety of our employees, customers and assets. We will also inform by means of signage in strategic locations and promulgate the Video Surveillance Policy.
Data Collection
Data is collected from a variety of sources, all of which are legal and in compliance with applicable data protection regulations. These sources may include information provided directly and consented to by customers, suppliers and collaborators in the course of business or contractual transactions and relationships, as well as data collected automatically through online interactions, such as websites and mobile applications. At AMBACAR, we are committed to collect personal data only from legitimate and verifiable sources, and always under the principle of informed consent, legitimate use or other cases provided by law. Before obtaining any personal data, we will inform the owners by different means about the purpose of the processing, i.e., how and for what purposes their data will be used. In addition, we will provide clear and concise information about their rights as holders of personal data, as well as the means to exercise those rights. The consent of the owner is a fundamental aspect in the collection of personal data. In order for data processing to be legitimate, we require that the owner grants free, specific, informed and unequivocal consent for the processing of his/her data. Consent will be requested clearly and in understandable terms, ensuring that the data subject is duly informed about the purpose of the processing and about his or her rights as a data subject. In addition, we will ensure that consent can be revoked at any time, allowing the data subject to withdraw his or her authorization for the processing of his or her data. The withdrawal of consent will not affect the lawfulness of the processing carried out prior to its revocation. It is important to emphasize that we will not use personal data obtained from dubious or unverifiable sources, and we will ensure that the data collected is adequate, relevant and limited to what is necessary to fulfill the established purpose. We will also implement security measures to protect personal data against any risk of loss, unauthorized access, destruction, alteration or improper disclosure.
General purpose of the processing of personal data at AMBACAR
AMBACAR's main purpose is to process personal data in order to provide highly personalized products and services to its customers, as well as to ensure operational efficiency and compliance with applicable regulations. This involves managing information to adapt to customers' individual preferences and needs, monitoring the quality of products and services, as well as regulatory compliance and constant improvement of its offerings. It also involves maintaining the security of its facilities and assets, effectively managing its employee and supplier base, and conducting market research and product development. In addition, it seeks to promote its products and services through direct marketing strategies and promotions, and to establish a strong relationship with customers throughout the pre-sales-sales-post-sales cycle, including support, warranties and technical services. Likewise, data transfers are made to third parties and strategic allies, always ensuring compliance with regulations and data security.
Description of the main purposes
- Analysis of customer preferences and needs: Here the specific preferences and needs of each customer are collected and analyzed. This makes it possible to tailor quotations and the products or services offered to individual demands.
- Attention to customer requests: Personal data is used to handle and manage customer requests and inquiries.
- Communication related to the requested quotation: This step involves interacting with the customer to discuss and clarify details about the quote, answer questions and ensure a mutual understanding of the terms and conditions.
- Communication related to products and services: This process encompasses general communication about the products and services offered by the company, including updates, promotions and highlights.
- Quality control of products and services: It involves evaluating and monitoring the quality of the products and services offered to ensure that they meet the company's standards and the customer's expectations.
- Customer contact: It refers to the continuous interaction with the customer to maintain a solid relationship and attend to any questions or concerns they may have.
- Contact with references: It refers to AMBACAR's interaction with the client's reference for different informative or corroboration purposes. The owner in all cases that provides the personal data of references ensures that he/she has the prior authorization of his/her referral.
- Commercial advisors contact: This process involves direct interaction between the company's commercial advisors and customers, providing advice and guidance on products and services.
- Procedural control: Personal data is used for the control and monitoring of the company's internal processes, ensuring their efficiency and compliance.
- Fulfillment of contracts: Personal data is used for the fulfillment of contracts with customers and suppliers.
- Regulatory Compliance: Personal data is used to comply with the obligations and requirements established by the applicable legislation.
- Preparation of quotations: This process involves the creation of cost estimates for products or services requested by customers. It includes pricing and details on the elements included in the offer.
- Enabling document management: Personal data are used to manage documents and procedures that enable the performance of activities within the company.
- Consent and preference management: Describes how customers' consent preferences are handled and how they can withdraw their consent at any time.
- Management and monitoring of indicators: Personal data is used for the management and monitoring of performance indicators and company performance.
- Management Collaborators: Personal data is used for the management and administration of the company's employees for the fulfillment of labor, social security and occupational health and safety obligations, including hiring, payroll and training processes.
- Warranty management and technical services: Personal data is used to manage product warranties and provide quality technical services, ensuring customer satisfaction.
- Fraud investigation and cyber security: If you use personal data to investigate possible fraud or to maintain your company's cyber security and data protection, this activity could be relevant.
- Research and development: Personal data is used to carry out research and development of new products or processes.
- Market research and quality analysis: Personal data may be used to carry out market research and quality analysis, which helps to continuously improve the products and services offered.
- Direct marketing and promotions: Personal data can be used to send promotions, discounts and special offers to customers, thus personalizing their experience and providing them with greater value.
- Improvement of products and services: Personal data are used for the continuous improvement of the products and services offered by the company, through analysis and feedback.
- Subject profiling and evaluation: Personal data is used to create profiles and evaluate subjects in order to offer them personalized products and services.
- Advertising and marketing: Personal data is used to carry out advertising and marketing activities of the company's products and services, activity that will be carried out directly or through third parties.
- Portfolio Recovery: Personal data are used for the management of portfolio recovery and extrajudicial and/or judicial collection directly or through third parties.
- Tool delivery record: Similar to the vehicle delivery record, this process documents the delivery of tools to customers, which may be relevant in rental or maintenance service contexts.
- Spare parts delivery record: The delivery of spare or replacement parts to customers, which is essential for the maintenance of vehicles or other equipment, is recorded here.
- Vehicle delivery record: Here the delivery of vehicles to customers is recorded, documenting the date, time and details of the vehicle delivered, which is crucial for tracking and security.
- Registration of repurchases: This refers to the documentation of repeat purchases made by a customer, which can be useful for loyalty and marketing strategies.
- Registration of the purchase of goods and services: It involves documenting the purchases of goods and services made by the company, which is important for cost control and financial management.
- Registration and management of suppliers: Personal data is used for the registration and management of suppliers of goods and services for the company.
- Security and surveillance: Personal data is used to ensure the security and surveillance of the company's facilities and assets.
- Transfer of data to allies and suppliers: Personal data may be transferred to strategic allies, technical and marketing service providers, as well as companies related to the sale of accessories and related services for vehicles, always ensuring compliance with applicable regulations and maintaining adequate security measures.
- Transfer of data to third parties: Personal data may be transferred to third parties, such as suppliers of accessories, technical consultancy, quality analysis and banking entities, always in compliance with applicable regulations and maintaining adequate security measures.
- International data transfer: If you make international transfers of personal data outside your home country, you must mention this activity and how the protection of such data is ensured in accordance with international privacy laws.
- Data transfer for statistical analysis: Personal data can be used in an anonymized form for the creation of internal statistical analyses, enabling data-driven decision making and improving operational efficiency.
- Transfer of data to allies and suppliers: Personal data may be transferred to strategic allies, technical and marketing service providers, as well as companies related to the sale of accessories and related services for vehicles, always ensuring compliance with applicable regulations and maintaining adequate security measures.
- Identity validation: Personal data is used to validate the identity of the company's customers, suppliers and collaborators.
Types of data collected
- Identifiers: names, surnames, age, type of document, identity card number, e-mail, telephone number, address, migratory information, passwords in case of digital platforms or equipment or computer systems owned by AMBACAR, gender, country, province, city.
- Biometric data: audio-video recordings, photographs, voice, and fingerprints.
- Supplementary data: information on assets, employment, family, income, transactional and commercial data and billing, product preferences and consumption habits, IP address from which the transaction is made, geolocation, navigation, vehicle license plates.
- Family Data: identifying information of spouse and other family members, income, home address, telephone numbers.
- Special category data: Credit and bank information, if you are a person with special abilities.
Transfer
At AMBACAR, the process of transferring personal data will be carried out in strict compliance with Chapter V of the Organic Law for the Protection of Personal Data (LOPDP) of Ecuador and other regulations in force. The following are the steps that will be applied to ensure the proper transfer of data:
- Holder's authorization: Before making any transfer of personal data to third parties, whether national or international, the express authorization of the owner of the data or the person acting as legal representative shall be obtained. This authorization shall be free, specific, informed and unequivocal, ensuring that the owner is fully informed about the purpose and destination of the transfer.
- Specific purpose: Any transfer of personal data will be made exclusively to fulfill a specific purpose previously established and authorized by the owner. No additional transfers or transfers not consented to by the holder will be made.
- International transfers: In the case of data transfers to foreign countries, additional measures will be applied to ensure an adequate level of protection of personal data, complying with the requirements established in the LOPDP and other applicable regulations.
- AMBACAR obligation: AMBACAR, through its agents, assumes responsibility for ensuring that all data transfers comply with legal requirements and appropriate security measures. In addition, it will verify that third party recipients of the data also comply with the same protection measures.
- Exceptions: AMBACAR will also transfer data under the exceptions established by the LOPDP in article 36. These exceptions include situations where the transfer is required by law, for the fulfillment of a contract to which the holder is a party or when there is a legitimate interest that prevails over the rights of the holder.
- Registration of transfers: A detailed record will be kept of all transfers of personal data carried out, indicating the purpose, destination, security measures implemented and the authorization granted by the owner.
Credit data
When handling credit data of your customers and collaborators, it is essential to comply with the provisions of Articles 28 and 29 of the Organic Law on Personal Data Protection (LOPDP) of Ecuador, which specifically refer to the processing of credit data for analysis.
- Legitimacy and lawfulness: All processing of credit data in AMBACAR must comply with the principles of legitimacy and lawfulness established in Article 28 of the Organic Law on Personal Data Protection (LOPDP) of Ecuador. Credit data must be obtained from legitimate and verifiable sources, such as publicly available sources or information provided by the creditor.
- Purpose of treatment: Credit data may only be used for the specific purpose of analyzing the solvency or creditworthiness of the holders, commercial conduct or ability to pay, and others related to the processes of AMBACAR, this includes commercial and advertising purposes.
- Confidentiality and prohibition of communication: Credit data are of a sensitive nature and must be treated with strict confidentiality. At AMBACAR, the communication or dissemination of this data to third parties is forbidden, except when permitted by law or with the express consent of the owner.
- Conservation period: Credit data may only be retained and used for their specific purpose for the period of time authorized by the holder, i.e. credit data relating to economic, financial, banking or commercial obligations may not be communicated after five years have elapsed since the obligation to which they refer has become due.
- Rights of the owners: In AMBACAR, the rights of credit data holders will be respected at all times, as established in article 29 of the LOPDP. The holders will have the right to personally access the information registered about them before the credit reference service providers, as well as to request through the ARCO form the update, rectification or deletion of information that is unlawful, false, inaccurate, erroneous, incomplete or outdated.
- Free access and verification mechanisms: The right of access to information on credit data will be free for the holders, and mechanisms such as direct observation through screens provided by the credit reference service providers will be provided, as well as the delivery of printouts of the reports to verify the truthfulness and accuracy of their content.
- Registration and access control: AMBACAR has systems in place to register and control access to credit data, ensuring that only authorized personnel have access to this information and keeping a detailed record of the activities carried out with the data.
- Training and awareness: All personnel involved in the processing of credit data will be trained and made aware of the importance of complying with the legal provisions and guidelines established to ensure the privacy and security of personal data.
- Evaluation and audit: Evaluations and audits will be carried out annually to verify compliance with the established guidelines, thus ensuring adequate protection of credit data and compliance with current regulations.
Special category of minors and health data
In case of processing special category data, such as data of minors or health data, in addition to the consent and normal process, the internal documentation will be adapted to ensure their protection and comply with legal requirements. In the case of adolescents over twelve (12) years old and under fifteen (15) years old, as well as children, in order to exercise their rights, they will need their legal representative. Adolescents over fifteen (15) years of age and under eighteen (18) years of age, may exercise their rights directly before the Personal Data Protection Authority or before the person responsible for the personal database of the processing. (Article 24 LOPDP).
Rights of owners
We will respect the rights of the holders of personal data, including the right of access, rectification, cancellation and opposition to the processing of their data. We established the ARCO form (access, rectification, cancellation and opposition) to attend and respond to the requests of the holders in relation to their rights.
Notification in case of a breach of information security
The processor shall notify the controller of any breach of personal data security as soon as possible, and at the latest within two (2) days from the date it becomes aware of it. The controller shall notify the personal data security breach to the Personal Data Protection Authority and the Telecommunications Regulation and Control Agency as soon as possible, and at the latest within five (5) days of becoming aware of it, unless the security breach is unlikely to constitute a risk to the rights and freedoms of natural persons. If the incident poses a risk to the rights and freedoms of data subjects, the affected parties must be notified and provided with information about the incident and the measures being taken to protect their data within 72 hours after the response from the relevant control body. It is not required to inform the holder when:
- When the authority of the data protection superintendence so indicates.
- When a disproportionate effort is required to do so; in which case, the controller shall make a public communication through any medium informing the data subjects of the personal data security breach.
Responsibility of the holder of personal data with respect to the referrals/referrals provided to AMBACAR
In the event that the owner provides data of third parties (for example, personal, commercial, family or other references), they guarantee that due authorization has been obtained from such persons to share their information with AMBACAR. Furthermore, it is confirmed that they have been informed about the purposes for which and the way in which their personal data will be processed. This includes the use of their data to verify the information provided and to obtain additional information in order to manage collection and related processes effectively. On the other hand, AMBACAR hereby grants services and functionalities that may require the processing of personal data of third parties, which may be provided by the user or customer. For example, this could occur in situations such as the purchase or sale of a vehicle, inquiries, credit applications or when authorizing a third party to carry out purchase procedures or other activities in AMBACAR's facilities. If at any time personal data of third parties is provided or if it is necessary to request such data from them in order to carry out a transaction on behalf of the user, it is guaranteed that such persons have been previously informed about the purposes and the treatment that will be given to their personal data by AMBACAR.
Exercise arch and portability rights (access, rectification, cancellation, opposition).
All persons authorized by law may exercise the aforementioned rights through the forms attached to this AMBACAR Personal Data Protection Policy. To do so, the signed form must be attached and sent to the channel: AMBACAR personal data mail.
Updating this policy
We will regularly review and update this policy to adapt it to regulatory and technological changes, and to continually improve our data protection practices.
Data of the person responsible for the processing of personal data:
- Company name: AMBACAR
- Address: Manuelita Saenz Av. and Antonio Clavijo Av.
- E-mail: [email protected]
- Telephone numbers: (03) 370-0410