top of page

Privacy Policy

PERSONAL DATA PROCESSING POLICY — DEMANDU, S.A.

 

 

1. 

OBJECTIVE

 

This policy aims to establish the guidelines for the collection, storage, use, circulation, and deletion of personal data processed by DEMANDU, S.A., in compliance with the provisions of Executive Decree No. 285 of May 28, 2021 (the “Regulation”), which regulates Law No. 81 of March 26, 2019 (the “PDP Law”), establishing mandatory guidelines for the protection of personal data, and other related regulations.

 

 

2. 

SCOPE

 

This policy applies to all personal information recorded in the databases of DEMANDU, S.A., which acts as the data controller.

 

 

3. 

OBLIGATIONS

 

This policy is of mandatory and strict compliance for DEMANDU, S.A.

 

 

4. 

DATA CONTROLLER

 

DEMANDU, S.A., along with any legal entities or individuals associated with the primary contract, are each individually responsible for the data stored in their databases.

 

 

5. 

DEFINITIONS

 

  • Privacy Notice: Verbal or written communication generated by the Data Controller addressed to the Data Subject, informing them about the existence of applicable data processing policies, how to access them, and the intended purposes of the data processing.

  • Authorization: Prior, express, and informed consent given by the data subject for the processing of their personal data.

  • Data Subject: The individual to whom the data refers.

  • Data Controller: The person who makes decisions regarding the data processing (i.e., purposes, means, scope, etc.).

  • Database Custodian: The person who acts on behalf of and under the responsibility of the data controller and is responsible for safeguarding the database.

  • Personal Data Protection Officer:

     

    • Public entities: The designated official in charge of the liaison unit.

    • Private entities: May designate a person to liaise with the data controller or database custodian. While this designation is not mandatory for private entities, it may be considered when determining the severity of any sanctions.

  • Recipient: A natural or legal person, public authority, service, or agency to whom personal data is transferred.

  • Exporter: A natural or legal person, public or private, domiciled in the Republic of Panama, who transfers personal data across borders.

 

 

6. 

TRANSFER AND TRANSMISSION OF PERSONAL DATA

 

DEMANDU, S.A. may transfer and transmit personal data to third parties with whom it has operational relationships necessary for its proper functioning or in accordance with its legal obligations. In such cases, necessary measures will be adopted to ensure that those with access to personal data comply with this Policy and the data protection principles and obligations established by law.

 

In case of data transfer, DEMANDU, S.A. will comply with the obligations stipulated in Executive Decree No. 285 of May 28, 2021 (“Regulation”) and Law No. 81 of March 26, 2019 (“PDP Law”), and other related provisions.

 

 

7. 

RIGHTS OF DATA SUBJECTS

 

Data subjects have the following rights:

 

  • Free access to the personal data processed.

  • To know, update, and correct their data when it is partial, inaccurate, incomplete, misleading, or when its processing is unauthorized or prohibited.

  • Request proof of the consent granted.

  • File claims before judicial authorities.

  • Revoke consent and/or request the deletion of data, provided no legal or contractual obligation prevents its removal.

  • Refuse to answer questions about sensitive data. Responding to questions concerning sensitive data of minors is optional.

 

 

8. 

HANDLING OF REQUESTS, INQUIRIES, AND CLAIMS

 

Data subjects may exercise their rights through the channels or means provided by DEMANDU, S.A.

 

The Legal Department is responsible for handling requests submitted by data subjects to enforce their rights.

 

 

9. 

PROCEDURE FOR EXERCISING THE RIGHT TO HABEAS DATA

 

In accordance with personal data protection laws, DEMANDU, S.A. outlines the procedure and minimum requirements for data subjects to exercise their rights.

 

To submit a request, the following information must be provided:

 

  • Full name and surname.

  • Contact information (physical and/or email address and phone numbers).

  • Means to receive a response.

  • Reason(s) or facts giving rise to the claim, including a brief description of the right being exercised (e.g., access, update, correction, proof of consent, revocation, deletion).

  • Signature (if applicable) and identification number.

 

The maximum legal term to resolve claims is fifteen (15) business days, counted from the day following receipt. If the claim cannot be resolved within this term, DEMANDU, S.A. will inform the claimant of the delay and indicate the date by which the claim will be resolved, which may not exceed eight (8) additional business days beyond the original term.

 

 

10. 

VALIDITY

 

This Personal Data Processing Policy is effective as of the signing of the contract. The personal data provided will be retained unless the data subject requests its deletion and provided there is no legal obligation to retain it.

bottom of page