1. DATA CONTROLLER

CURTIDURÍA TUNGURAHUA SA with RUC 1890074703001, domiciled in the city of Ambato, PARQUE INDUSTRIAL AMBATO, TERCERA ETAPA, CALLE 8 S/NYF, as RESPONSIBLE for the processing of the personal data of the owner, obtained through legitimate verbal or written consent and in accordance with the provisions of the ORGANIC LAW ON THE PROTECTION OF PERSONAL DATA (LOPDP), makes the following PRIVACY POLICY available to inform the owner of the data to be processed and protected by the organization.

2. TERMS AND DEFINITIONS

• CONTROLLER: A natural or legal person who, alone or jointly with others, decides on the purpose and processing of personal data.
• MANAGER: Natural or legal person, public or private, who alone or jointly with others processes personal data on behalf of and for the account of a data controller.
• OWNER: Natural person whose data is being processed.
• PERSONAL DATA: Data that identifies or makes a natural person identifiable, directly or indirectly.
• SPECIAL DATA: Personal data: sensitive, of girls, boys and adolescents, health and of people with disabilities.
• SENSITIVE DATA: Data relating to ethnicity, gender identity, cultural identity, religion, ideology, political affiliation, judicial history, immigration status, sexual orientation, health, biometric data, genetic data, and any data whose improper processing may give rise to discrimination or violate or may violate fundamental rights and freedoms.

3. LEGITIMATE BASIS THAT AUTHORIZES THE PROCESSING

CURTIDURÍA TUNGURAHUA SA bases its processing of personal data on the grounds established in Article 7 of the Organic Law on the Protection of Personal Data, including:

• By consent of the owner in credit applications, promotional videos, collaborator data.
• In compliance with legal obligations in labor and tax matters
• For compliance with contractual measures in collection.
• To satisfy the legitimate interest of the Controller for security and surveillance in the facilities

4. PURPOSE OF THE PROCESSING AND PERSONAL DATA PROCESSED:

In order to provide our services to clients or third parties, or for our collaborators to perform their functions, it is necessary for the DATA CONTROLLER to process, obtain, collect, classify, store, record, use, extract, consult, view, or transfer, and in general, handle the personal data of the data subjects, in accordance with the provisions of the LOPDP. Therefore, CURTIDURÍA TUNGURAHUA SA will process the following personal data of the owner for the following purposes:

CUSTOMERS:

Purpose of the Treatment	Collection and use of data for marketing and product offering
Data Subject	Potential Clients
Data processed	Names and surnames, telephone number and address

Purpose of the Treatment	Using data to generate credit applications
Data Subject	Clients, Spouses and Guarantors
Data processed	Names and surnames, email, telephone number and address, RUC or ID, marital status, nationality, age or date of birth, profession, Gender Liabilities, assets, equity, credit bureau, bank accounts

Purpose of the Treatment	Using data to generate credit applications
Data Subject	Debtor References
Data processed	Names and Surnames, Address, Relationship, Telephone Numbers

Purpose of the Treatment	Creating databases in an accounting system for billing
Data Subject	Customers
Data processed	Names and surnames, email, telephone number and address, tax identification number (RUC) or ID, marital status

Purpose of the Treatment	Creating databases in an accounting system for billing
Data Subject	Customers
Data processed	Names and surnames, email, telephone number and address, tax identification number (RUC) or ID, marital status

Purpose of the Treatment	Collection of Accounts Receivable
Data Subject	Clients, Spouses and Guarantors
Data processed	Names and surnames, email, telephone number and address, tax identification number (RUC) or ID, marital status gender Accounts receivable

Purpose of the Treatment	Legal actions against overdue customers (judicial collection)
Data Subject	Clients, Spouses and Guarantors
Data processed	Names and surnames, email, telephone number and address, RUC or ID, marital status, nationality, age or date of birth, profession, gender Gender Liabilities, assets, equity, credit bureau, bank accounts

Purpose of the Treatment	Using data to generate billing in the accounting system
Data Subject	Customers
Data processed	First and last name, ID number, email, address, phone number

Purpose of the Treatment	Appearance in Curtiduría Tungurahua’s promotional marketing videos (only with customer consent)
Data Subject	Customers
Data processed	Faces

Purpose of the Treatment	Surveillance through closed-circuit cameras
Data Subject	Visitors
Data processed	Faces

CONTRIBUTORS:

Purpose of the Treatment	Use for selection and recruitment processes: checking references, assessing skills, qualifications or suitability for the job
Data Subject	Aspiring Collaborators
Data processed	First and last name, email address, phone number, age, date of birth, education, employment references, marital status, criminal record.

Purpose of the Treatment	Registration and use of collaborator data to record activities in each process
Data Subject	Collaborators
Data processed	First and last name, ID number, email, address, phone number

Purpose of the Treatment	Personnel entry and legalization in the company, registration in the system, entry into the SUT, entry into the IESS
Data Subject	Collaborators
Data processed	First and last name, email, phone number, gender, age, date of birth, education, employment references, marital status, copy of ID, bank account

Purpose of the Treatment	Use of data for calculating and paying utilities
Data Subject	Employee’s Spouse and Dependents
Data processed	Birth Certificate or ID Card

Purpose of the Treatment	Determine the medical fitness of workers for the position or job
Data Subject	Collaborators
Data processed	First and last names, age, position, education, home address, anthropometric data, employment history, emergency contacts, marital status Disability data: type and percentage Sensitive Data: gender, race or ethnicity Health Information: Allergies, blood type, illnesses, family and personal medical history, vaccinations, unhealthy consumption, lifestyle, laboratory test results, and diagnoses.

Purpose of the Treatment	Use of data in occupational accident management
Data Subject	Collaborators
Data processed	First and last name, email address, phone number, gender, race or ethnicity, age, education, employment information, marital status, harmful consumption, home address Disability data: type and percentage

Purpose of the Treatment	Admission and legalization of interns and/or trainees in the company, admission to the SUT, admission to the IESS (interns only)
Data Subject	Interns
Data processed	Names and surnames, email, telephone number, gender, age, date of birth, education, employment references, marital status, copy of ID

SUPPLIERS:

Purpose of the Treatment	Data collection for supplier purchases
Data Subject	Supplier
Data processed	Names and surnames, email, telephone number and address, tax identification number

Purpose of the Treatment	Exchange of information and data for purchases with international suppliers
Data Subject	Supplier
Data processed	Names and surnames, signatures, emails
Purpose of the Treatment	Using data for dividend and invoice payments in the accounting system
Data Subject	Supplier
Data processed	First and last name, ID number, email, address, phone number, bank account number

5. PRIVACY OF CHILDREN AND ADOLESCENTS

Data relating to children and adolescents will be processed exclusively when the aforementioned data processing respects their best interests, ensures respect for their fundamental rights, and is aligned with the provisions of the Children and Adolescents Code, and for the sole purpose of determining the number of dependents of the employee. This data will be kept strictly confidential and will only be accessible to the Human Talent Department of Curtiduría Tungurahua.

6. PRIVACY OF PEOPLE WITH DISABILITIES OR SPECIFIC NEEDS

The data of children and adolescents will be processed exclusively when the aforementioned data processing respects their best interests, ensures respect for their fundamental rights, and for the sole purpose of determining the number of dependents of the employee or complying with legal employment requirements. This data will be kept strictly confidential and will only be accessible to the Human Talent Department of Curtiduría Tungurahua.

7. RIGHTS OF THE HOLDER AND PROCESS TO EXERCISE THEM

Personal data and control over it belong to the data subject. Therefore, the data subject or interested party may exercise the rights stipulated in the LOPDP, as indicated below:

• Right of Access: the owner or interested party can know what personal data is being processed.
• Right to Rectification and Update: The owner or interested party may modify or update their personal data.
• Right to Deletion: The owner or interested party may request the deletion of their personal data when:
  • It is not necessary or relevant for the purpose for which it was initially collected; or if the data subject or owner does not have any active products, services, or obligations with the CONTROLLER.
  • The retention period has expired.
  • Consent is revoked or the owner indicates that it has not been granted.
  • Do not conflict with a regulatory or legal requirement.
• Right to Object: The owner or interested party may object or refuse the use of their personal data when:
  • Their fundamental rights and freedoms are affected.
  • The law allows its exercise.
  • The processing is for purposes other than those for which it was collected and/or if it is not necessary to maintain the contractual relationship.
  • In other cases established in the Organic Law on the Protection of Personal Data.
  • This right may be exercised as long as the information is not public, in the public interest, or if the processing is not mandated by law.
• Right to Suspension of Processing: the owner or interested party may request the cessation of the processing of their data when:
  • You contest the accuracy of your personal data.
  • It is necessary to limit its use.
  • The right to erasure may not be exercised for legal or contractual reasons, but it is possible to suspend the processing of the data subject’s data.
• Right to Data Portability: The data subject or interested party may obtain all their personal data or request that it be transferred to another CONTROLLER.

It is important to note that the Data Subject’s Rights are not absolute, and therefore a favorable resolution will be obtained provided that it does not conflict with any legal measure stipulated by the Ecuadorian State, that the Data Subject does not have a contractual obligation with the CONTROLLER, or that there is no other cause for denial, as determined by the LOPDP, its Regulations, and other regulations. To exercise your rights, we need you to send us the following information ( download ), and send it to the email protecciondatos@ctu.com.ec or, failing that, come to our offices to leave it in person, and within 15 days from receiving the request, as stipulated by the LOPDP, a resolution will be given.

8. TRANSFER OF PERSONAL DATA

Curtiduría Tungurahua must transfer data to other RESPONSIBLE organizations with which it maintains contracted services and that need to process the personal data of our clients, collaborators and suppliers, and may share your personal information with these duly authorized third parties, requiring them to maintain adequate standards of confidentiality, protection and security of personal data. These companies may include, but are not limited to:

• Regulatory entities such as Dinardap to comply with legal credit obligations (only for clients with credit)
• Regulatory entities such as the IRS and the Superintendency of Banks to comply with legal tax obligations (customers and suppliers).
• Regulatory entities such as IESS and the Ministry of Labor (only collaborators).
• Clinical Laboratories for medical-occupational examinations (only collaborators).
• Insurance Companies or Insurance Brokers, Consumer Goods Chains, Pharmacies and/or Telecommunications Companies (only for employees who receive social and voluntary benefits).

Tungurahua Tannery must transfer data from its international suppliers for the exchange of information and data for international purchases of chemicals, leather, machinery and spare parts through secure means and taking into account the exception criteria of Art. 60 literal 3: “When the international transfer is intended to comply with a legal or regulatory obligation (transactional and tax compliance of raw materials, machinery, and supplies).”

9. CONSENT

Tungurahua Curriculum will provide the data subject or interested party with the appropriate technical resources to freely and voluntarily grant their consent. This consent will be collected through physical or digital acceptance or other means, or through acceptance of this data privacy policy. The data subject may deny or revoke consent for the use and processing of their data at any time, provided there is no legal requirement to do so. However, the data subject understands that by doing so, they will no longer be able to access Curtiduría Tungurahua’s services and/or products that require the processing of their data.

10. EFFECT OF PROVIDING ERRONEOUS OR INACCURATE DATA

If the data subject has provided erroneous, inaccurate, or outdated information, this could result in their requests being denied or in the inability to provide quality service.

11. SECURITY AND PROTECTION OF PERSONAL DATA

Tungurahua Curriculum safeguards data with high security standards, guaranteeing the integrity, confidentiality, and availability of your information. Additionally, we employ security measures to safeguard personal data, and we require that employees and managers who process this personal data do so confidentially and with integrity, and with the utmost respect for individual privacy.

12. DATA RETENTION PERIOD

The data subject’s data will be retained solely and exclusively for the time necessary to fulfill the processing purposes and for a maximum of 7 years, which is the statutory timeframe established by applicable legal regulations and for a maximum of the time required for the statute of limitations for legal actions. After this period, the data will be deleted or blocked in accordance with the procedures implemented by the CONTROLLER, except for employee data, which will be stored indefinitely due to labor legal requirements.

13. DATA PROTECTION CONTACTS OF THE ORGANIZATION

If you need to contact Curtiduría Tungurahua to exercise any right of the owner or for support in the revocation or modification of consent, you can do so by email at protecciondatos@ctu.com.ec , or go to the Ambato city office, AMBATO INDUSTRIAL PARK, THIRD STAGE, 8TH STREET S/NYF, or by phone at +593 32434141.

14. CHANGES TO THE PRIVACY POLICY

Any changes or updates to this privacy policy will be notified through our website.

CHANGE CONTROL
VERSION	DESCRIPTION CHANGES	PREPARED (name – position)	REVIEWED (name – position)	APPROVED (name – position)	APPROVAL DATE
01	Policy Development	Milton Cruz, Certification Inspector	Gonzalo Callejas General Manager	Gonzalo Callejas General Manager	February 14, 2025