Habeas Data y Privacidad

Política de Tratamiento de Datos Personales

En Tisanas Orquídea S.A.S. garantizamos el derecho fundamental al habeas data de los titulares de datos personales, definiendo los principios y procedimientos aplicables a su tratamiento.

Última actualización: septiembre de 2026

1. Objective

TISANAS ORQUÍDEA S.A.S., pursuant to Article 15 of the Political Constitution of Colombia, Statutory Law 1581 of 2012, Regulatory Decree 1377 of 2013 (compiled in Decree 1074 of 2015), Decree 090 of 2018, SIC Circular 001 of 2025, Law 2153 of 2025, and other applicable circulars and instructions issued by the Superintendence of Industry and Commerce (SIC), adopts this policy to guarantee the fundamental right to habeas data of the data subjects whose personal information is processed by the company, defining the principles, conditions, and procedures applicable to the collection, storage, use, circulation, and deletion of personal data.

2. Scope and Responsibilities

This policy applies to the processing of personal data of employees, customers, suppliers, visitors, and any data subject whose personal information is processed by TISANAS ORQUÍDEA S.A.S. as Data Controller.

General Management is the Data Controller; Human Talent oversees employee data; Commercial manages customer and supplier data. The management of habeas data requests and data subject care is entrusted to the Human Resources and Administration Department as the designated responsible team for this purpose.

3. Identification of the Data Controller

4. Personal Data Processing Policy

4.1 Processing Principles

TISANAS ORQUÍDEA S.A.S. applies the following legal principles in all personal data processing activities:

  • Legality: Processing is conducted in full compliance with Statutory Law 1581 of 2012 and concordant regulations.
  • Purpose: Personal data is collected for specific, explicit, and lawful purposes, and will not be processed for purposes incompatible with those disclosed to the data subject.
  • Freedom: Processing requires prior, express, and informed consent from the data subject, unless exempted by legal or judicial mandate.
  • Veracity and Quality: Information must be true, complete, accurate, updated, verifiable, and understandable.
  • Transparency: The data subject is entitled to obtain information regarding their personal data at any time and without restriction.
  • Security: Technical, human, and administrative measures are adopted to safeguard data against unauthorized access, loss, falsification, or illicit use.
  • Confidentiality: All persons involved in processing personal data are legally obligated to maintain professional secrecy and confidentiality.
  • Restricted Access and Circulation: Processing is limited to individuals authorized by the data subject or empowered by law. Personal data is not published on mass media or open internet channels without technical access controls.

4.2 Purposes of Processing

The company processes personal data for the following specific purposes:

  • Employee data: Execution of the employment contract, payroll and disbursements, affiliation to the social security system, statutory reporting to the UGPP and the DIAN via magnetic media, management of the Occupational Health and Safety Management System (SG-SST), medical leave processing, performance reviews, internal corporate communications, and fulfillment of legal duties.
  • Customer data: Order management, invoicing, product shipping, transactional notifications, commercial communications, and customer support, with the data subject's prior consent.
  • Supplier data: Contractual management, payments, vendor performance evaluations, tax reporting to the DIAN via magnetic media, and legal compliance.
  • Visitor data: Access control, physical security, and asset protection on company premises.

4.3 Rights of Data Subjects

In accordance with Law 1581 of 2012, data subjects possess the right to:

  • Know, update, and rectify their personal data before the Data Controller.
  • Request proof of the authorization granted for data processing.
  • Be informed, upon request, about how their personal data has been used.
  • File complaints with the Superintendence of Industry and Commerce (SIC) for violations of personal data protection regulations, after exhausting the direct claim procedure with the company.
  • Revoke authorization and/or request data erasure when there is no ongoing legal or contractual duty justifying continued retention.

4.4 Procedure for the Exercise of Habeas Data Rights

The data subject or their authorized representative may file a habeas data request in writing with the Human Resources and Administration Department of TISANAS ORQUÍDEA S.A.S. through the designated email notificacionestisanas22@gmail.com or via physical communication delivered to company headquarters (Carrera 72i #37D-53 Sur, Bogotá D.C.), specifying full name, identification number, clear description of the right exercised, and supporting documents.

  • Inquiries (Consultas): Inquiries will be answered within a maximum period of ten (10) business days from receipt. If it is not possible to respond within this timeframe, the applicant will be informed prior to expiration, and the response will not exceed an additional five (5) business days (Art. 14, Law 1581 of 2012).
  • Claims (Reclamos): Claims will be resolved within a maximum period of fifteen (15) business days, extendable by eight (8) additional business days with prior notification to the data subject (Art. 15, Law 1581 of 2012).

4.5 Data Subject Authorization

  • Employee data is processed on the basis of express authorization contained in the Personal Data Processing Authorization Form signed upon hiring.
  • Customer and supplier data is processed on the basis of authorization granted when initiating the commercial relationship, communicated via privacy notice by email or accepted through digital web forms. For purposes derived from statutory legal duties (DIAN tax reports, magnetic media), processing is grounded in Article 10 of Law 1581 of 2012.

4.6 Sensitive Data and Data of Minors

  • Sensitive data: TISANAS ORQUÍDEA S.A.S. processes sensitive employee data strictly when essential to meet statutory obligations, particularly under SG-SST, medical leave management, and social security. Such processing requires express authorization, is strictly restricted to its justifying purpose, and is stored with reinforced security measures. Processing sensitive data of customers, suppliers, or third parties is prohibited, except under express legal mandate.
  • Data of minors: The company does not directly collect or process data belonging to minors, except when required by statutory obligations (such as employee dependents for family subsidy or social security), always requiring prior authorization from the child's legal representative.

4.7 Security and Data Retention

  • Personal data will be stored for the period strictly necessary to fulfill the processing purposes or applicable statutory timeframes:
    • Employment records: minimum twenty (20) years pursuant to Colombian social security regulations.
    • Customer and supplier records: ten (10) years in accordance with Article 46 of the Colombian Commercial Code and DIAN tax duties.
    • Unselected job applicants: up to two (2) years from conclusion of the hiring process, unless deletion is requested earlier.
  • The company implements role-based access controls, cryptographic safeguards, passwords, data backups, and technical security measures proportional to processing risks.

4.8 National Registry of Databases (RNBD)

TISANAS ORQUÍDEA S.A.S. has registered its databases with the National Registry of Databases (RNBD) administered by the Superintendence of Industry and Commerce (SIC), pursuant to Decree 090 of 2018, keeping said registry updated in accordance with statutory guidelines.

4.9 Cookies and Tracking Technologies

The use of cookies and tracking technologies across the website is specifically governed by our independent Cookie Policy, which you can consult at www.orquideainfusiones.com/pages/politica-cookies.

4.10 Term and Dissemination

This policy will be shared with internal staff via institutional Google Drive, with customers and suppliers via email, and is published on the official corporate website. It becomes effective upon its approval date and will be reviewed every two (2) years or whenever regulatory changes or new processing activities require an update.

Designated Habeas Data Contact: For inquiries, claims, or personal data requests, write directly to notificacionestisanas22@gmail.com.