Privacy Policy

Privacy Policy

Ashley Personal Data Processing Policy


Data Controller: CLOVER4 SAS , with Tax Identification Number (NIT) No. 901.513.909-1, with registered address at Avenida Carrera 19 #109-41 in Bogotá, Colombia (hereinafter "ASHLEY and/or the company "), shall act as the party responsible for the collection, storage, use, processing, updating, circulation, deletion, transfer, transmission and, in general, any operation or set of operations on and regarding your personal data.

This ASHLEY Privacy and Personal Data Processing Policy (hereinafter the "Policy") establishes the terms and conditions under which ASHLEY will carry out the processing to which personal data provided through physical stores, the ASHLEY website, related microsites, mobile versions, social media and/or any other mechanism or channel enabled by ASHLEY for the collection of personal data will be subjected.

Before purchasing any product and/or service offered by ASHLEY, you must carefully read this Policy so that you are aware of your rights, ASHLEY's obligations, the channels available for exercising your rights, the procedures established for inquiries and complaints, the purposes for which your personal data was collected, and other relevant information regarding current personal data regulations.

By accepting this Personal Data Processing Policy, the data subject is informed and grants their free, informed, specific, and unequivocal consent for the processing of the personal data provided to ASHLEY, as well as any data derived from their browsing activity and any other data they may provide in the future.

1. Regulatory Framework Applicable to Processing: The legal and constitutional framework (hereinafter the "Regulatory Framework") governing the Policy is as follows:

  • Political Constitution of Colombia.
  • Law 1266 of 2008.
  • Law 1581 of 2012.
  • Decree 1377 of 2013, incorporated into Single Decree 1074 of 2015.
  • Other regulations incorporated into the legal system that may be applicable.

2. Definitions and Principles: The concepts presented below are derived from current regulations. In the event that these definitions are modified, supplemented, and/or replaced, their meaning shall be as indicated in the applicable legal provisions in force:

  • Authorization: Prior, express, and informed consent of the Data Subject to carry out the processing of personal data.
  • Database: An organized set of personal data that is subject to processing.
  • Personal Data: Any information linked to or that may be associated with one or more identified or identifiable natural persons.
  • Processing: Any operation or set of operations on personal data or personal databases, such as the collection, storage, use, circulation, or deletion of data.
  • Data Subject: A natural person whose personal data is subject to processing.
  • Data Controller: A natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the processing of the data.
  • Data Processor: A natural or legal person, public or private, that by itself or in association with others, carries out the processing of personal data on behalf of the Data Controller.
  • Personal Data Protection Department: The department within the company responsible for overseeing, monitoring, and promoting the application of the Personal Data Processing Policy.

The processing of information collected by ASHLEY shall be governed by the following principles:

  • Principle of Legality: The Regulatory Framework governing the Processing of Personal Data shall be applied in the Processing thereof.
  • Principle of Freedom: The processing of personal data shall only be carried out with the prior, express, and informed consent of the data subject.
  • Principle of Purpose: The processing of personal data shall serve a legitimate purpose, which shall be communicated to the respective data subject.
  • Principle of Accuracy or Quality: The Protected Information subject to Processing must be truthful, complete, accurate, up-to-date, verifiable, and understandable. ASHLEY shall not be liable to the Data Subject when partial, incomplete, fragmented, or misleading data is processed.
  • Principle of Transparency: The right of the data subject to obtain information about their data at any time and without restrictions must be guaranteed.
  • Principle of Restricted Access and Circulation: Processing may only be carried out by persons authorized by the Data Controller or by persons provided for by law.
  • Principle of Security: Personal Data subject to the Policy and processed by ASHLEY shall be protected to the extent that technical resources and minimum standards allow, through the adoption of necessary technical, human, and administrative measures to ensure the security of electronic records, preventing their alteration, modification, loss, unauthorized access, and in general, against any unauthorized or fraudulent use or access.
  • Principle of Confidentiality: Personal data that is not public in nature is confidential and may only be disclosed in accordance with the law. Any person involved in the processing of information must guarantee its confidentiality.
  • Principle of Temporality: The storage and processing of personal data shall be limited to what is essentially necessary to fulfill the previously specified purposes of the business relationship, as well as to comply with the purposes authorized by the Data Subject.

3. Scope of the Policy: This Policy shall have the same scope of application established in the Regulatory Framework. Accordingly, it shall apply to all operations carried out by ASHLEY in Colombia, safeguarding any use or processing of Protected Information by affiliated companies, in compliance with legal requirements.

4. Personal Data and Consent for Processing: ASHLEY obtains personal data from Data Subjects through its physical stores, the Website, social media, or through other channels.

The Data Subject expressly consents to the processing (collection, storage, use, circulation, deletion) of Protected Information by accepting the authorization requested through documents, on the website, or through other means of obtaining personal data.

The Personal Data that will be subject to processing includes: identification data, contact data, location and geolocation information, browsing data, data classified as sensitive (for example: health-related data, fingerprints, photos, video recordings, and other biometric data), financial information, asset information, socioeconomic data, employment and academic information, preferences, tastes and consumer behavior, data inferred or not from information observed or provided directly by the Data Subject or by third parties, and demographic and transactional information. Personal Data shall be collected through the various channels made available by ASHLEY.

If ASHLEY requests sensitive personal data such as racial or ethnic origin, political orientation, religion, biometric data, etc., the Data Subject's response shall be optional.

ASHLEY only collects and receives personal information voluntarily provided by Data Subjects through the channels made available for that purpose and only from persons of legal age.

ASHLEY does not process data of minors, but in the event that the processing of such data is required, ASHLEY shall protect such data with special care and shall comply with the provisions of Articles 6 and 12 of Decree 1377 of 2013 and Article 5 of Law 1581 of 2012.

If the Data Subject provides data of third parties, they declare that they have their consent and commit to providing them with the information contained in the Policy, exempting ASHLEY from any liability in this regard. Notwithstanding the foregoing, ASHLEY may carry out periodic verifications to confirm this fact, adopting appropriate due diligence measures in accordance with data protection regulations.

5. Purposes of Processing: The personal data provided to ASHLEY by Data Subjects shall be collected, stored, used, analyzed, circulated, updated, reported, and generally processed for the following purposes:

As the controller of the data collected, ASHLEY maintains several databases, which it declares shall be processed for one or more of the following purposes:

Administrative, Accounting, and Legal Management:

  • Carry out corresponding invoicing and complete all tax, accounting, fiscal, and legal procedures and obligations.
  • Administration and formalization of commercial agreements and contracts with suppliers of goods and service providers.
  • Administration of Contracts with Third Parties.
  • Carry out the relevant procedures for the development of the pre-contractual, contractual, and post-contractual stages and with respect to any underlying negotiation, as well as to comply with Colombian or foreign law and with orders from judicial or administrative authorities.
  • Verify the identity of the data subject, conduct security studies, and/or implement security protocols to prevent and mitigate the risk of fraud, money laundering, and/or terrorism financing.
  • Perform Website usage analysis and verify the preferences and behaviors of the Data Subject in order to improve communication with Website Data Subjects. Manage and respond to inquiries, requests, petitions, incidents, complaints, and claims.
  • As a tool for the collections process.
  • As support for external and internal audits.
  • So that the information may be transferred and/or transmitted to ASHLEY's parent companies, subsidiaries, or subordinate companies, or to third parties with which ASHLEY has alliances or contractual relationships for any of the purposes set forth herein, who may be located outside the national territory.
  • For the advancement of any procedure before a public authority or a private person or entity, with respect to which the information is relevant.
  • Guarantee the data subject, at all times, the full and effective exercise of the right of habeas data, the rights included in Law 1581 of 2012, and all applicable regulations on the matter.
  • Know, store, and process all information provided by personal data subjects in one or more databases, in the format deemed most convenient and secure.
  • Conduct data update campaigns for the purposes described in this Policy.
  • If the nature of the activities so requires, report to Credit Bureaus on the compliance or non-compliance with obligations acquired with ASHLEY.
  • Manage relationships with clients and suppliers to facilitate internal accounting, administrative, and financial processes.

6. Commercial Management: The personal information of potential clients, clients, suppliers, and contractors may be processed in accordance with the following purposes:

  • Seek, establish, maintain, and execute a contractual or commercial relationship, whatever its nature.
  • Develop commercial and marketing activities, such as consumption analysis; profiling; brand traceability; sending news, advertising, promotions, offers, and benefits; customer loyalty programs; market research; and generation of campaigns and events.
  • Send commercial communications to the Data Subject regarding benefits, advertising, promotions, offers, news, discounts, customer loyalty programs, market research, generation of campaigns and events, through electronic and conventional means, and in general regarding the offering of products and services of ASHLEY, (i) of companies with which ASHLEY collaborates, and; (ii) of companies affiliated with ASHLEY.
  • Notify you about purchases, orders, shipments, news, or events related to the products or services you acquire or contract.
  • Conduct quality and satisfaction surveys to learn the opinions of Data Subjects about ASHLEY's products and services.
  • Manage, process, send, and track quotations and purchases made.
  • Contact the Data Subject to complete their purchase if they have saved products in their shopping cart without completing the process.

7. Human Resources and OHS Management System: Purposes of processing within recruitment and/or hiring processes.

  • Fulfill the purposes of the Company's recruitment and/or hiring process, evaluate their suitability and/or potential hiring.
  • Verify and confirm the accuracy of the information included in the resume and any other document or information provided to the Company.
  • Conduct security checks on the candidate, which includes reviewing or obtaining criminal records, conducting home visits, and consulting data at credit bureaus, among others.
  • Be part of the applicant database for future hiring.
  • Sending communications about recruitment processes similar to those in which the data subject has participated.
  • Comply with the Company's hiring policies.
  • Perform background checks in accordance with binding compliance programs, such as crime prevention, ethics, and free competition.
  • Request supporting documents for their resume, medical examinations, psychological tests, and any other necessary information.
  • Manage the Companies' human resources in accordance with applicable legal and contractual terms.
  • Comply with the legal obligations of the companies in their capacity as employers, including, but not limited to, payroll management, social benefits, comprehensive social security system, occupational risk prevention, etc.
  • Monitoring and tracking of active and inactive personnel for statistical purposes.
  • Manage the Occupational Health and Safety Management System (OHS-MS) in order to mitigate risks, as well as the proper handling of incidents or events during the performance of various work activities.
  • Manage employee training and development programs.
  • Promote the development of welfare activities, action plans, staffing, and comprehensive development of employees in their work environment.
  • Use personal information and images generated within the framework of the Companies' activities, processes, and events to share them internally and externally through digital channels, social media, WhatsApp, YouTube, or any other means of communication; as well as the creation and distribution of physical, digital, or audiovisual advertising material.
  • Carry out physical and digital security risk management activities for the employing company through video surveillance devices and biometric registration.
  • Carry out due diligence and disciplinary investigation procedures related to the management of legal or reputational risks, such as fraud, potential crimes, violations of free competition, information leaks, or any other risk defined by the company.
  • Register, process, and store the information provided in complaints and/or inquiries filed with the company.

8. Technology and Security:

  • Promote controls over the company's IT and technology systems to manage passwords, users, software licenses, and technology support.
  • Ensure the security of personal and financial information of suppliers and employees, while ensuring that we have complete and sufficient information to provide them with the best service.
  • Video Surveillance. ASHLEY may use video surveillance installed at various internal and external locations of its commercial establishments, facilities, or offices. Therefore, it informs the general public about the existence of these mechanisms and will make them known in a visible location. The information collected through these mechanisms is used for security purposes, to improve services, and to enhance the visitor experience. It is also used as evidence in any type of proceeding before any authority or body.

ASHLEY shall process your Personal Data for as long as necessary to fulfill the aforementioned purposes, and/or for as long as necessary to comply with legal or contractual obligations.

All Personal Data collected by ASHLEY shall be processed exclusively for the purpose and objective for which it was provided.

Personal Data may be processed through physical, automated, or digital means, depending on the type and method of information collection.

ASHLEY may subcontract certain functions to third parties. When the processing of personal information is subcontracted to third parties or personal information is provided to third-party service providers, ASHLEY informs such third parties of the need to protect said personal information with appropriate security measures, prohibits them from using the information for their own purposes, and requests that they not disclose the personal information to others.

9. Transmission and Transfer of Personal Data: ASHLEY may transmit or transfer personal data to its parent company, affiliates, subsidiaries, branches, affiliated companies, or third parties located within or outside the territory of the Republic of Colombia. This transfer of personal data must be carried out in strict compliance with the provisions of this Data Processing Policy, the security standards implemented, and ensuring compliance with the applicable principles established in this Policy.

By accepting this Policy, the Data Subject acknowledges that, in the event of a sale, merger, consolidation, change of corporate control, substantial transfer of assets, reorganization, or liquidation of ASHLEY, ASHLEY may transfer, dispose of, or assign the Personal Data to one or more relevant parties, including affiliated companies.

10. Rights and Obligations of Data Subjects: Data Subjects, by themselves or through a third party legitimately authorized to do so, may exercise the following rights with respect to the Personal Data subject to Processing:

  • Know, update, and rectify their Personal Data. This right may be exercised, among others, with respect to partial, inaccurate, incomplete, fragmented data that may be misleading, or whose processing is expressly prohibited or has not been authorized.
  • Request proof of the authorization granted to the Data Controller, except when such authorization is not required by law.
  • Be informed by the Data Controller or the Data Processor, upon request, regarding the use that has been given to their Personal Data.
  • File complaints with the Superintendence of Industry and Commerce for violations of the provisions of the Regulatory Framework, following an inquiry or request submitted to the Data Controller.
  • Partially or fully revoke the authorization and/or request the deletion of personal data, except when such data must remain in the database of the Data Controller or the Data Processor due to legal or contractual obligations.
  • Access their Personal Data that has been subject to processing free of charge.
  • Know the Personal Data Processing Policy and any substantial changes that may occur.
  • Refrain from answering questions about sensitive data. Responses regarding sensitive data or data about children and adolescents are optional.
  • Other rights granted by current legal regulations.

11. Duties of the Data Controller: ASHLEY is obligated to:

  • Guarantee the Data Subject, at all times, the full and effective exercise of their rights.
  • Request and keep a copy of the respective authorization granted by the Data Subject.
  • Inform the Data Subject, clearly and sufficiently, about the purpose of the collection and the rights they have in their capacity as Data Subject.
  • Maintain the information under the necessary security conditions in order to guarantee its duty of confidentiality at all times.
  • Rectify the information when appropriate.
  • Request express authorization from the Data Subject to confirm and rectify the personal information provided, by contacting public entities, specialized companies or credit bureaus, their contacts, or their employer, as well as their personal, banking, or employment references, among others.
  • Provide the Data Processor, as applicable, only with data whose processing has been previously authorized in accordance with the provisions of this law.
  • Require the Data Processor to respect at all times the security and privacy conditions of the Data Subject's information.
  • Process inquiries and complaints submitted within the terms established by current regulations on the matter.
  • Guarantee the principles of legality, freedom, purpose, accuracy or quality, transparency, restricted access and circulation, security, confidentiality, and temporality of information under the terms established in the Policy.

12. Handling of Inquiries, Requests, and Complaints: ASHLEY has established a department responsible for handling and resolving inquiries, requests, and complaints from personal data subjects or those authorized to do so. For this purpose, the following channels are designated for handling inquiries, requests, and complaints:

Email: Privacidad@ashleycolombia.com

Address: Avenida Carrera 19 #109 – 41 Bogotá D.C., Colombia

In the complaint or inquiry, the data subject must provide their full name and identification. In the case of a third party, they must prove that they are the authorized person to file the complaint or inquiry. They must also include a precise and complete description of the facts giving rise to the complaint, request, or specific inquiry; a physical or electronic address for sending the response and providing timely information on the status of the process; and, in the case of complaints, the documents or evidence they deem pertinent or wish to submit.

ASHLEY shall address and respond to complaints or requests from Data Subjects within the deadlines and terms established for that purpose by the Regulatory Framework.

The Data Subject, notwithstanding the foregoing, and in the event that their request or complaint has not been addressed by ASHLEY, may in any case subsequently appeal to the Superintendence of Industry and Commerce as a second instance.

Procedure for Filing Inquiries, Petitions, and Complaints: ASHLEY shall have the following procedures for handling inquiries, complaints, petitions, claims, and suggestions submitted by Data Subjects:

Inquiries and Petitions: The data subject, their successors, or any other person with a legitimate interest shall submit inquiries through written communication or by email, in which:

  • They determine their identity, including their name and identification number.
  • The reason for the inquiry must be clearly and expressly specified.
  • The legitimate interest with which the person is acting must be demonstrated, always attaching the appropriate supporting documents.
  • Indicate the physical or electronic mailing address to which the response to the request may be sent.

In accordance with Article fourteen (14) of Law 1581 of 2012, it is established that: "The inquiry shall be addressed within a maximum period of ten (10) business days from the date of receipt. When it is not possible to address the inquiry within said period, the interested party shall be informed, stating the reasons for the delay and indicating the date on which the inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the first period."

Complaints: The data subject, their successors, or any other person with a legitimate interest who considers that the information contained in a database should be subject to correction, updating, deletion, or revocation of the authorization granted for processing, or when they become aware of the alleged non-compliance with any of the duties contained in Law 1581 of 2012, may, through physical or electronic means, file a timely complaint with the responsible department. In accordance with Article fifteen (15) of Law 1581 of 2012, said complaint shall be admissible once compliance with the requirements presented below has been verified:

The Complaint must:

i) include the identity of the complainant, indicating their name and identification number;

ii) clearly and expressly specify the reason for the inquiry;

iii) demonstrate the legitimate interest of the complainant, always attaching the appropriate supporting documents; and

iv) indicate the physical or electronic mailing address to which the response to the request must be sent. If the complaint is incomplete, "the interested party shall be required within five (5) days following receipt of the complaint to remedy the deficiencies. If two (2) months have elapsed from the date of the requirement without the applicant submitting the required information, it shall be understood that the complaint has been withdrawn."

In the event that ASHLEY is not competent to resolve the complaint, it shall refer it to the appropriate party within a maximum period of two (2) business days and shall inform the interested party of the situation.

The maximum period for addressing the complaint shall be fifteen (15) business days from the day following the date of receipt. When it is not possible to address it within said period, the interested party shall be informed of the reasons for the delay and the date on which the complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the first period.

ASHLEY may deny access to Personal Data or the right to rectify, cancel, or oppose the processing of such data when: (i) the applicant is not the Data Subject or the legal representative is not duly accredited to do so; (ii) the applicant's Personal Data is not in its Database; (iii) the rights of a third party are violated; (iv) there is a legal impediment or, as applicable, a resolution from a competent authority that restricts access or prevents the rectification, cancellation, or opposition to the processing of such data; (v) the rectification, cancellation, or opposition has already been carried out; and (vi) the Data Subject has a legal or contractual obligation with ASHLEY to remain in its Information Systems.

13. Personal Data Security Measures: ASHLEY has implemented the necessary and sufficient measures to ensure that this Policy is respected at all times, establishing administrative, technical, and physical security measures that facilitate the protection of your Personal Data, as well as prevent any damage, loss, alteration, destruction, or unauthorized use thereof.

14. Validity and Modifications: The Personal Data provided shall be retained as long as its deletion is not requested by the interested party (unless requested and there is a legal obligation to retain it). ASHLEY's databases shall have an indefinite validity period, given that the processing thereof shall be necessary as long as the legal entity and the development of its corporate purpose exist; in any case, this period shall not be less than (50) years. This version of this policy is effective as of the date of its publication, which replaces in its entirety any previous data processing provision or policy, and shall be in effect indefinitely and for the entire time that ASHLEY carries out the activities described herein and these correspond to the processing purposes that inspired this policy.

15. Applicable Law and Jurisdiction: This document shall be governed and interpreted in accordance with the laws of the Republic of Colombia. Any dispute arising from this document shall be submitted to the competent courts in accordance with Colombian law, and both Ashley and the Data Subject expressly waive any other jurisdiction that may correspond to them by reason of their current or future domicile.