Personal Data Processing Policy

Chapter I. General provisions

Article 1. Purpose

This policy sets out the criteria under which Corporación Talento Minero Colombiano, hereinafter CTMC, collects, stores, uses, circulates, updates and deletes the personal data of the people it deals with, and defines the procedures for data subjects to exercise their fundamental right of habeas data; CTMC adopts this policy because its purpose, connecting the talent, capabilities and territories of the mining and energy sector, depends on the trust of those who hand over their information.

Article 2. Legal framework

This policy implements articles 15 and 20 of the Colombian Political Constitution, Statutory Law 1581 of 2012, Decree 1377 of 2013 and Decree 886 of 2014, compiled in Single Regulatory Decree 1074 of 2015, Decree 090 of 2018, Title V of the Single Circular of the Superintendence of Industry and Commerce, Law 1098 of 2006 as regards children and adolescents, and the case law of the Constitutional Court, in particular Ruling C-748 of 2011; any later rule that amends this framework shall be deemed incorporated into the policy from its entry into force.

Article 3. Scope

The policy applies to all databases and files, physical or digital, that contain personal data processed by CTMC as controller, as well as to the processors that handle data on CTMC's behalf, and it binds the members of the governing bodies, employees, contractors, volunteers and partners who, for any reason, access that data.

It does not apply to information about legal entities, although it does apply to the data of the natural persons who represent them or act as their contacts.

Article 4. Identification of the controller

1. Legal name: Corporación Talento Minero Colombiano (CTMC), a non-profit entity.
2. Tax ID (NIT): 901.953.115-6.
3. Registered office and address: Calle 11C n.º 73-52, Bogotá D.C., Colombia.
4. Email for personal data matters: contacto@talentominerocolombiano.org.
5. Telephone: +57 320 268 1000.
6. Website: www.talentominerocolombiano.org.

Article 5. Definitions

For the interpretation of this policy, the definitions of Law 1581 of 2012 and its regulatory decrees are adopted, together with some specific to CTMC's activity:

1. Authorization: the prior, express and informed consent of the data subject for the processing of their personal data.
2. Privacy notice: a verbal or written communication addressed to the data subject informing them of the existence of this policy, how to access it and the purposes of the processing.
3. Database: an organized set of personal data subject to processing.
4. Personal data: any information linked to, or that may be associated with, one or more identified or identifiable natural persons.
5. Public data: data that is not semi-private, private or sensitive, such as data on marital status, profession or trade, or status as a merchant or public servant.
6. Semi-private data: data that is neither intimate, confidential nor public and whose knowledge may be of interest to a certain sector or group of people.
7. Private data: data that, because of its intimate or confidential nature, is relevant only to its data subject.
8. Sensitive data: data that affects the privacy of the data subject or whose misuse may lead to discrimination, such as racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions or social or human rights organizations, health data, sex life data and biometric data.
9. Processor: a natural or legal person who processes personal data on behalf of the controller.
10. Controller: the person who decides on the database and the processing of the data; for the purposes of this policy, CTMC.
11. Data subject: the natural person whose personal data is processed.
12. Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
13. Transfer: sending personal data to a recipient that is in turn a controller, inside or outside the country.
14. Transmission: communicating personal data to a processor, inside or outside the national territory, so that it carries out processing on behalf of the controller.
15. Capability profile: the set of information a data subject records in the Mining Capability Registry about their training, experience, capabilities, context of application and evidence.
16. Verification level: the degree of verification CTMC assigns to a registered capability, according to the criteria CTMC defines and publishes.
17. Anonymized data: information that, because of the procedure applied, no longer makes it possible to identify a person or a small group of people, even when combined with other reasonably available sources.

Article 6. Principles

CTMC will apply in a harmonious and comprehensive manner the principles of legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality set out in article 4 of Law 1581 of 2012, and it also voluntarily assumes the following commitments:

1. Minimization: it will only collect the data necessary for each purpose and will always prefer the least invasive option.
2. Privacy by design: each new form, platform or project, including the Mining Capability Registry, will be designed considering data protection from the outset and the most protective configuration by default.
3. Demonstrated accountability: CTMC will document its decisions, authorizations, security measures and incidents, so that it can demonstrate compliance to data subjects and to the authority.
4. Human intervention: no decision that has significant effects on a person, such as their verification, visibility or selection, will be made exclusively through automated processes.
5. Respect for the territories: information about communities and territories will be handled with a differential approach, without exposing people or groups, and recognizing the forms of organization proper to ethnic peoples.

Chapter II. Databases, purposes and special processing

Article 7. Data subjects and databases

CTMC may process personal data of the following groups of data subjects, organized in the databases indicated:

1. Contacts and website visitors: people who write through forms, email or social media.
2. Talent and professionals: people who register in the Mining Capability Registry or take part in the Mining Talent Hub, bootcamps or other training and employability activities.
3. Representatives and contacts of organizations: people acting on behalf of mining companies, contractors, suppliers, educational institutions, public bodies and partners.
4. Recruitment leaders and speakers: people who take part as counterparts, experts or lecturers in programs and events.
5. Members, directors and governing bodies: members of the general assembly, the board of directors and other bodies of the corporation.
6. Collaborators: employees, contractors, volunteers and interns, as well as candidates for engagement.
7. Research participants: people who take part in Proyecto Hablemos or other CTMC studies.
8. Participants in outreach activities: including children and adolescents, through their legal representatives.
9. Authors and readers of the Mining Forum and Opinion: people who propose or publish content and those who subscribe to communications.
10. Donors and cooperating parties: natural persons who support the corporation financially or in kind.

Article 8. Purposes of the processing

Personal data will be processed exclusively for the purposes reported at the time of collection, which include the following:

1. Answering requests, inquiries, proposals and messages received through any channel.
2. Creating, managing, verifying and displaying capability profiles in the Mining Capability Registry, according to the visibility settings chosen by the data subject.
3. Connecting professionals, suppliers and institutions with the sector's needs, job opportunities, projects or calls, always with the corresponding authorization.
4. Organizing, calling and running training programs, bootcamps and in-person, virtual or hybrid events, and issuing certificates of participation.
5. Managing relationships with partners, cooperating parties, donors, suppliers and public bodies, including the agreements, reports and obligations arising from them.
6. Conducting research and studies on talent, capabilities, labor gaps and territorial perceptions, and publishing their results only in aggregated or anonymized form.
7. Sending newsletters, invitations and institutional news to those who have accepted them, with the option to unsubscribe at any time.
8. Managing the Mining Forum and Opinion, including the identification of authors, editorial review and comment moderation.
9. Complying with legal, statutory, accounting, tax and labor obligations, and responding to requests from competent authorities.
10. Managing the engagement, performance and termination of employment, contractual or volunteer relationships.
11. Measuring the use of the website and platforms to improve how they work, by means of statistical information.
12. Ensuring the security of people, facilities and CTMC's information systems.
13. Preparing studies, statistics, indicators and reports on the talent and capabilities of the mining and energy sector, and disseminating or commercializing them only with aggregated or anonymized data, in accordance with article 8A.
14. Sharing or transferring contact and professional profile data to companies, educational institutions and partner organizations in the sector so that they can present data subjects with job, training, project or service opportunities, including in exchange for financial consideration for CTMC, only when the data subject has authorized it expressly and separately, in accordance with article 8A.
15. Sending to those who have expressly accepted it information from CTMC's partners about opportunities, events, programs or services in the sector, with the option to cancel these communications at any time.

CTMC will not sell, rent or assign identifiable personal data to third parties without the prior, express and informed authorization of the data subject for that specific purpose, and when the use of the data generates income, it will be allocated to the development of the corporation's corporate purpose.

Article 8A. Responsible use of data

CTMC recognizes that information about mining and energy talent has value for the sector and that its responsible use can contribute to the sustainability of the corporation, so any use of the data, including use that generates income, will be subject to the following rules:

1. Separate and optional authorization: the purposes in items m), n) and o) of article 8 will be authorized separately from the authorization required for engagement, by means of an optional checkbox, and no registration, engagement, service or activity of CTMC will be conditional on the data subject accepting them.
2. Data that is never shared: CTMC will not transfer to third parties identity document numbers, sensitive data or data of children and adolescents, nor will it use them for commercial purposes.
3. Conditions for recipients: every transfer will be recorded in a written agreement in which the recipient undertakes to use the data only for the authorized purpose, not to assign it to others, to apply adequate security measures, to honor the rights of data subjects and to delete the data once the purpose has been fulfilled.
4. Traceability: CTMC will keep a record of transfers, with the date, the recipient, the data delivered and the authorization supporting them, and the data subject may ask at any time to be told to whom their data has been delivered.
5. Anonymization: studies and reports will be prepared with aggregated or anonymized data, and no results will be published or delivered that correspond to groups of fewer than ten people or that, combined with other reasonably available sources, make it possible to identify someone.
6. Revocation: the data subject may withdraw the optional authorizations at any time without affecting their relationship with CTMC, and from that moment their data will not be included in new transfers.
7. Use of income: the resources obtained will be allocated to the corporation's corporate purpose, in keeping with its nature as a non-profit entity.

Article 9. Processing in the Mining Capability Registry

Because of its nature, the Mining Capability Registry receives specific treatment, subject to the following rules:

1. Registration is voluntary and the data subject decides what information to include in their profile.
2. Profile visibility will be configurable by the data subject; by default, contact information will not be public and will only be shared with third parties when the data subject authorizes it for a specific connection.
3. Organizations that consult the Registry will only access the information the data subject has enabled and according to the permissions CTMC grants them, and they will undertake to use it exclusively for the declared purpose.
4. Documents the data subject provides as evidence will be used only to verify their capabilities and will not be published without their express authorization.
5. Verification levels express the degree of verification carried out by CTMC; they do not constitute a certification of competencies, a professional endorsement or a guarantee of performance.
6. Any recommendation or supply-and-demand matching feature will be for guidance only, and the data subject may learn the general criteria used, request human review of a decision that affects them and object to that processing.
7. The data subject may update, hide or delete their profile at any time through the channels provided in this policy.

Article 10. Research and Proyecto Hablemos

1. Participation will be voluntary and preceded by informed consent explaining the purpose of the study, the use of the information and the right to withdraw.
2. Information will be collected with the least possible identification and will be pseudonymized or anonymized as soon as the analysis allows.
3. Results will only be published in aggregated form, at scales that prevent the identification of people, families or small groups.
4. CTMC will not publish information that makes it possible to single out a community without the authorization of its representative bodies, and it will respect the forms of government and decision-making proper to ethnic peoples and communities, obtaining the corresponding permits before any activity in their territories.
5. Identifiable data collected in the field will be kept only for the duration of the project and the period for verifying its results, and will then be deleted or anonymized.

Article 11. Sensitive data

CTMC will only process sensitive data when strictly necessary, with the explicit authorization of the data subject or in the other cases set out in article 6 of Law 1581 of 2012; in particular, it may process information on health or disability for reasonable accommodations in events and training or in well-being programs, and data on ethnicity, gender or place of origin to measure inclusion and apply a differential approach, preferably in aggregated form.

When requesting sensitive data, CTMC will inform the data subject that they are not obliged to provide it, which data is sensitive and the purpose of its processing, and no activity will be conditional on the data subject providing sensitive data.

Article 12. Children and adolescents

The processing of data of children and adolescents will respect their best interests and fundamental rights, in accordance with article 7 of Law 1581 of 2012 and article 12 of Decree 1377 of 2013; authorization will be granted by their legal representative, after the minor has exercised the right to be heard according to their maturity, and in addition:

1. Only the minimum data necessary for the educational or outreach activity will be collected.
2. Data of minors will not be used for profiling, advertising or commercial communications.
3. Photographs or videos of minors will only be taken and published with the authorization of the legal representative, seeking to keep them unidentifiable.

Article 13. Images, voice and video

At events and activities, CTMC may record photographs, audio and video for its institutional memory and to disseminate its activities; attendees will be informed through visible notices and may ask not to be recorded or to have their image removed from later publications, and a person's image will only be used for commercial purposes or in a prominent close-up with their express authorization.

Article 14. Website, cookies and analytics

CTMC's website may use technical cookies, necessary for it to work, and analytics cookies, which make it possible to measure the use of the site statistically; CTMC will report their use through a notice on the site and, where the tool allows it, will offer options to accept or reject them, and data subjects can also block them in their browser settings.

Chapter III. Authorization

Article 15. Authorization of the data subject

Except for legal exceptions, all processing requires the prior, express and informed authorization of the data subject, which may be granted in writing, electronically, orally provided a record is kept, or through unequivocal conduct from which it can reasonably be concluded that it was granted; silence does not constitute authorization.

When requesting it, CTMC will inform the data subject of the processing and its purpose, the optional nature of answers about sensitive data or data of minors, the rights they have and the channels for exercising them, as well as the identification of the controller.

Article 16. Cases in which authorization is not required

Authorization will not be required when the information is requested by a public or administrative entity in the exercise of its legal functions or by court order, when it concerns data of a public nature, in cases of medical or health emergency, when the processing is authorized by law for historical, statistical or scientific purposes, or when it concerns data related to the Civil Registry of Persons, in accordance with article 10 of Law 1581 of 2012.

Article 17. Proof and retention of the authorization

CTMC will keep proof of the authorizations obtained, including the date, the means and the text accepted, for as long as the data is processed and for any additional period required by law.

Article 18. Privacy notice

When it is not possible to make this policy available to the data subject at the time of collection, CTMC will provide a privacy notice stating, at a minimum, the identity and contact details of the controller, the processing and its purposes, the rights of the data subject and how to access this policy.

Chapter IV. Rights of data subjects

Article 19. Rights

In accordance with article 8 of Law 1581 of 2012, data subjects have the right to:

1. Access, update and correct their personal data with CTMC or its processors.
2. Request proof of the authorization granted, except where the law does not require it.
3. Be informed, upon request, about the use made of their data.
4. File complaints for violations of the law with the Superintendence of Industry and Commerce, once the inquiry or claim procedure before CTMC has been exhausted.
5. Revoke the authorization and request the deletion of their data when the constitutional and legal principles, rights and guarantees are not respected, and in the other cases permitted by law.
6. Access their personal data subject to processing free of charge.

As good practice, CTMC will also handle requests from data subjects who wish to object to a specific processing or to receive a copy of their capability profile in a commonly used format.

Article 20. Persons entitled

The rights may be exercised by the data subject, proving their identity; by their successors, proving that status; by their representative or attorney, proving the representation; or by stipulation in favor of another, and the rights of children and adolescents will be exercised by those empowered to represent them.

Chapter V. Duties of CTMC and of processors

Article 21. Duties of CTMC as controller

CTMC will comply with the duties set out in article 17 of Law 1581 of 2012, including guaranteeing the data subject the exercise of habeas data, keeping a copy of the authorization, reporting the purpose of the collection, keeping the information under secure conditions, ensuring that the information provided to processors is accurate and up to date, handling inquiries and claims within the legal terms, informing the data subject upon request of the use made of their data and reporting breaches of security codes to the data protection authority.

Article 22. Duties of processors

Processors that handle data on CTMC's behalf will comply with the duties set out in article 18 of Law 1581 of 2012 and with the obligations of the transmission contract or agreement they sign with CTMC, and may only process the data in accordance with the instructions received.

Chapter VI. Procedures for exercising rights

Article 23. Responsible area and service channels

Petitions, inquiries and claims will be handled by CTMC's Legal Representation, which will act as data protection officer and may rely on the people it designates for the day-to-day management of the mailbox; data subjects may submit their requests through the following channels, free of charge:

1. Email: contacto@talentominerocolombiano.org.
2. The website contact form, selecting the corresponding reason.
3. Written communication addressed to CTMC's registered office.

Article 24. Inquiries

The data subject or those entitled may consult the personal information held in CTMC's databases, and the inquiry will be answered within a maximum of ten (10) business days from the date of receipt; when it is not possible to answer within that term, the interested party will be informed of the reasons for the delay and the date on which it will be answered, which may not exceed five (5) business days after the first term expires.

Article 25. Claims

Anyone who considers that the information contained in a database should be corrected, updated or deleted, or who notices an alleged breach of any of the legal duties, may file a claim containing the identification of the data subject, a description of the facts, the address for notifications and the documents they wish to submit, under the following procedure:

1. If the claim is incomplete, the interested party will be asked within five (5) days of its receipt to correct the deficiencies, and if two (2) months pass from the date of the request without the information being provided, the claim will be deemed withdrawn.
2. If CTMC is not competent to resolve it, it will forward it to the appropriate party within a maximum of two (2) business days and will inform the interested party of the situation.
3. Once the complete claim has been received, the legend «claim in process» and the reason will be added to the database within no more than two (2) business days, and will remain until the claim is decided.
4. The maximum term to handle the claim will be fifteen (15) business days from the day after its receipt; when it is not possible to handle it within that term, the interested party will be informed of the reasons for the delay and the date on which it will be handled, which may not exceed eight (8) business days after the first term expires.

Article 26. Revocation of authorization and deletion

The data subject may revoke their authorization or request the deletion of their data at any time, in whole or in part; the request will not proceed when the data subject has a legal or contractual duty to remain in the database, or when the data must be kept to comply with legal obligations, in which case CTMC will inform them and will limit the processing to what is strictly necessary.

Article 27. Procedural requirement

The data subject or their successors may only file a complaint with the Superintendence of Industry and Commerce once they have exhausted the inquiry or claim procedure before CTMC, in accordance with article 16 of Law 1581 of 2012.

Chapter VII. Security, transmission and transfer

Article 28. Security measures

CTMC will adopt technical, human and administrative measures proportionate to the nature of the data and the risks of the processing, including role-based access control, strong authentication on institutional accounts, encryption in transit for the website and platforms, backups, confidentiality agreements with those who access the data and regular training of its team.

Article 29. Incident management

In the event of any incident that compromises the security of personal data, CTMC will activate its internal response procedure, take measures to contain its effects, report it to the Superintendence of Industry and Commerce within fifteen (15) business days of its detection, in accordance with that entity's instructions, and notify the affected data subjects when the incident may pose a risk to their rights, indicating the measures they can take to protect themselves.

Article 30. Transmission to processors

CTMC uses technology service providers, such as website hosting, forms, email and cloud storage, which may be located outside Colombia and act as processors; the transmission of data to these providers will take place through a transmission contract or through their contractual terms when these offer equivalent guarantees, under the terms of Decree 1377 of 2013, and preferably to countries that the Superintendence of Industry and Commerce considers to have an adequate level of protection.

Article 31. Data transfer

CTMC will only transfer personal data to other controllers, such as companies, institutions or partner organizations in the sector, with the express authorization of the data subject for that purpose and under the conditions of article 8A, or in the cases exempted by article 26 of Law 1581 of 2012, and international transfers will conform to the conditions set by law and by the data protection authority.

Chapter VIII. Retention, registration and validity

Article 32. Retention period

Data will be kept only for the reasonable and necessary time to fulfill the purposes that justified its processing, taking into account the applicable provisions and administrative, accounting, tax and legal aspects; as reference criteria, CTMC will apply the following periods, which may be adjusted through its internal records management procedure:

1. Contact messages and requests: up to two (2) years after the last communication.
2. Mining Capability Registry profiles: while the profile is active; after two (2) years without activity, CTMC will consult the data subject and, if there is no answer, will delete or anonymize the profile.
3. Participants in events and training: up to five (5) years, to issue certificates and measure results.
4. Accounting, labor and contracting information: for the terms established by law.
5. Identifiable research data: for the duration of the project and the period for verifying its results, in accordance with article 10.

Article 33. National Database Registry

CTMC will register its databases in the National Database Registry when it is obliged to do so under Decree 090 of 2018, which currently requires registration of non-profit entities with total assets above 100,000 tax value units (UVT); the corporation will verify this condition every year and will in any case keep an up-to-date internal inventory of its databases.

Article 34. Amendments

Any substantial change to this policy will be communicated to data subjects through the website or the registered email before it is implemented, and when the change concerns the purpose of the processing, CTMC will obtain a new authorization from the data subject.

Article 35. Validity

This policy is effective from its publication on CTMC's website; the databases will remain in force for as long as the purposes justifying the processing are maintained, and the policy will be reviewed at least once a year or whenever the applicable regulations change.

Annexes. Authorization templates and notices

Annex A. Authorization for website forms

I authorize Corporación Talento Minero Colombiano (CTMC) to process my personal data in order to answer this request and, if I check the box, to send me institutional information; I know that I can access, update, correct and delete my data and revoke this authorization through contacto@talentominerocolombiano.org, and that the Personal Data Processing Policy is available at www.talentominerocolombiano.org/politica-datos.

Annex B. Authorization for the Mining Capability Registry

I authorize CTMC to process the data and documents I record in the Mining Capability Registry in order to create my capability profile, verify the information, assign verification levels and connect me with opportunities in the sector; I understand that I decide what information is visible, that my contact details will only be shared with an organization when I authorize it, that verification levels are not a certification of competencies and that I may request human review of any decision that affects me, and answering requests for sensitive data is optional.

Annex C. Authorization by a legal representative for minors

I, [name], holder of [ID document], as legal representative of [name of the child or adolescent], authorize CTMC to process their personal data for the sole purpose of their participation in the activity [name], and [do / do not] authorize the recording and publication of their image in institutional media; I declare that the minor was heard and that I know their data will not be used for profiling or advertising.

Annex D. Privacy notice

Corporación Talento Minero Colombiano (CTMC), with registered office in Bogotá D.C. and email contacto@talentominerocolombiano.org, will be the controller of the personal data you provide to us, which will be processed for [purpose]; you have the right to access, update, correct and delete your data and to revoke the authorization, and you can consult our Personal Data Processing Policy at www.talentominerocolombiano.org/politica-datos.

Annex E. Notice for events with image recording

At this event CTMC will take photographs and videos for its institutional memory and to disseminate its activities; if you do not wish to appear, please tell the organizing team or write to us at contacto@talentominerocolombiano.org to have your image removed from any publication.

Annex F. Authorizations for registration and membership application forms

The first authorization is mandatory to process the registration or membership; the second is an optional checkbox that the person may leave unchecked, and it does not affect their admission to the corporation.

F.1 Authorization required for registration or membership (mandatory). I authorize Corporación Talento Minero Colombiano (CTMC), NIT 901.953.115-6, as data controller, to collect, store and use my personal data in order to manage my registration in the directory or my membership, as applicable, and my participation in the entity's activities, governing bodies and processes, in accordance with Law 1581 of 2012 and CTMC's Personal Data Processing Policy, which I can consult at https://www.talentominerocolombiano.org/politica-datos.html; at any time I may access, update, correct or request the deletion of my data by writing to contacto@talentominerocolombiano.org.

F.2 Optional uses (checkbox that may be left unchecked). In addition, I accept the optional uses described in article 8A of CTMC's Personal Data Processing Policy, namely studies with anonymized data, connection with partners in the sector and the sending of opportunities.