For YANAPI S.A. (hereinafter referred to as “the company” or simply “YANAPI”), the handling of all your data is important. Therefore, we provide you with the following Privacy Policy, through which we inform you, in accordance with the Organic Law on Personal Data Protection (LOPDP) in Ecuador, about the processing we carry out regarding the information you provide us and collect, the purposes for processing, among other important aspects for your consideration.
In this document, we specifically inform you about:
The type of information we collect, its origin, and the purposes for processing it.
The legal basis for data processing.
How long we retain the information.
With whom we share such information.
The means through which you can contact us to exercise your rights.
Scope
This Privacy Policy for YANAPI S.A. (the “Policy”) is directed at business partners, suppliers, customers, employees, interns, collaborators, contractors, and, in general, anyone whose data is being or will be processed by YANAPI S.A.
Legal Basis
The Ecuadorian legal system recognizes and guarantees the right to the protection of personal data. The Constitution of the Republic of Ecuador (hereinafter, CRE), in Article 66, number 19, states:
CRE. “Art. 66.- Persons shall be recognized and guaranteed: 19. The right to the protection of personal data, which includes access and decision on information and data of this nature, as well as their corresponding protection. The collection, filing, processing, distribution, or dissemination of this data or information shall require the authorization of the owner or the mandate of the law.”
Likewise, this Policy is based, in particular, on the Organic Law on Personal Data Protection (LOPDP), which, according to Article 2, applies “to the processing of personal data contained in any type of medium, automated or not, as well as to any modality of subsequent use.” This regulatory framework states that the processing of personal data will be legitimate and lawful if one of the following conditions is met (Article 7, paragraphs 1, 2, 3, 5, 7, and 8):
LOPDP. “Art. 7.- Legitimate processing of personal data. – The processing will be legitimate and lawful if it complies with any of the following conditions:
By the consent of the owner for the processing of their personal data, for one or more specific purposes;
Carried out by the data controller in compliance with a legal obligation;
Carried out by the data controller, by court order, observing the principles of this law;
The processing of personal data is based on the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the controller, derived from a competence attributed by a norm with the rank of law, subject to compliance with international human rights standards applicable to the subject matter, compliance with the principles of this law, and the criteria of legality, proportionality, and necessity;
For the execution of pre-contractual measures at the request of the owner or for the fulfillment of contractual obligations pursued by the data controller, data processor, or by a third party legally authorized;
To protect vital interests, of the interested party or another natural person, such as their life, health, or integrity;
For the processing of personal data contained in public access databases; or,
To satisfy a legitimate interest of the data controller or third party, provided that the interest or fundamental rights of the owners prevail, as provided in this regulation.”
The Policy uses the thirteen principles defined in the LOPDP for any processing of data from the owner or interested party.
Data Controller
YANAPI S.A., with R.U.C 1790775623001, located at Llanganates No. E2-22 and Tomebamba, Quito-Ecuador EC 170901 (hereinafter, YANAPI), with phone number 02-2651401, acts as the data controller for the data collected and stored in our systems.
This information may come from our website, public access information systems, links from other websites, as well as the information you provide us through communication channels such as forms and direct messaging via social networks.
As required by law, we are responsible for your personal information, ensuring that we have applied the necessary technical, organizational, and administrative measures to protect it.
Organizationally, all requests will be channeled through the email protecciondedatos@yanapi.com, by phone using YANAPI S.A.’s number, or at its legal address; so that the Data Protection Officer, in this case, Ms. Carina Cañar, can respond to requests and fulfill her duty to supervise compliance with current legal regulations and cooperate with the competent authorities in this matter.
Purposes of Processing Customer and Supplier Data at YANAPI
YANAPI collects your information to always offer you a better product and service. Due to the nature of our business, the information we process is collected solely for the following purposes:
• Customers: Conduct risk analysis, commercial profiles, offers of our products/services, and their improvement. Also, to manage any claims related to orders and inform you about any updates to our product catalog. In the case that you are a representative, guarantor, beneficiary, or spouse, either of the owner or the interested party who gave consent, we commit to process your data for the management of the contract in which you are involved.
• Suppliers: Analysis of suppliers in pre-selection processes, validation of references, selection, and qualification. Also, for the implementation of contracts and their fulfillment, specifically monitoring the provision of the contracted service and/or delivery of the contracted product.
In this sense, the Policy aims to: guarantee the rights of the Owners or interested parties (whether natural or legal persons); make known the mechanisms and procedures to enforce these rights; inform the communication channels of the company to address queries, questions, claims, and complaints; and, finally, make known the purposes and Treatments.
We store your data from the moment you access our websites (through cookies, if you accept their use), when you request more information about the product (when filling out our contact forms or sending the catalog to your email), or when you log in to our websites, through user registration. Storage is maintained until the purposes for which the information was processed are fulfilled, with strict respect for the times indicated in the applicable regulations and for the maximum period required for the prescription of legal actions. After this time, the data will be deleted, anonymized, or blocked, in accordance with the mechanisms, tools, and strategies implemented and defined by YANAPI S.A.
On each of our platforms, we handle information in accordance with the provisions of this privacy policy.
Among the purposes of processing your data as a customer or supplier, specifically and without the following list being exhaustive, are:
• To contact you;
• To provide you with good service or a good product;
• To manage your orders and check the status of your requests; and,
• To promote our products and services.
By reading this and clicking accept on the website, you declare that you are aware of the document and authorize YANAPI expressly to process your data. This consent will be collected by accepting the privacy statement through digital channels, verbally, or other means used by YANAPI.
Purposes of Employee Data Processing at YANAPI
YANAPI, acting as the Data Controller, gathers, stores, uses, circulates, and deletes data related to natural persons with whom it has or has had an employment relationship, for the proper development of its business activities and to strengthen its relationships with third parties. The collected data serves the following purposes:
Administer and operate, directly or through third parties, the processes of staff selection and recruitment, including the evaluation and qualification of participants, verification of work and personal references, as well as conducting security studies.
Develop human resources management activities within YANAPI, such as payroll, affiliations to entities of the general social security system, well-being and occupational health activities, exercise of the employer’s sanctioning powers, among others.
Make necessary payments derived from the execution of the employment contract and/or its termination, and other socio-economic benefits, in accordance with applicable law.
Contract labor benefits with third parties, such as life insurance, medical expenses, among others.
Notify authorized contacts in case of emergencies during working hours or in the course of work.
Coordinate the professional development of employees, employees’ access to employer’s IT resources, and provide support for their use.
Plan business activities.
Generally, to comply with contractual and legal obligations (e.g., labor, social security, and occupational health regulations).
Types of Data
For clients and suppliers of YANAPI, data categories encompass types specified by law and, especially, the following: (i) identification and contact information; and (ii) financial information. In the case of YANAPI employees, additional data categories, in addition to those mentioned, include: (i) identification and contact information; (ii) financial information; and (iii) employment-related information, which includes, for example, information on occupational health, criminal records, among other information necessary for the purposes described in the Policy.
When a user visits YANAPI’s websites, digital behavior data obtained from platforms and media centers assigned to cookies or devices and other tracking technologies are collected. This information, obtained with the corresponding consents from third parties, includes your IP address, domain name, browser version, operating system, traffic and location data, web logs, accessed resources, and other communication data.
Types of Processing
Collection, obtaining, recording, and organization, conservation, custody, modification, elimination, indexing, extraction, consultation, preparation, use, possession, utilization, distribution, assessments, and automated decisions, profiling, transfer, communication, or transfer; provided that each of these activities complies with relevant legal standards and the processing purposes stated in the Policy.
The incorporation into files, profiling, and automated data processing aim to link the data subject/interested party with YANAPI and its respective maintenance, management, administration, provision, expansion, improvement, or sending of updates to services or products. Similarly, it aims to make new services or products available to the data subject or interested party, sending information via traditional and electronic means regarding technical, operational, and commercial information about products, promotions, and services offered or that YANAPI may offer in the future. The purpose of data registration and automated processing also includes sending survey forms, which the data subject or interested party is not obliged to answer.
Retention Period
We retain your data for the period necessary to fulfill the purposes described in this Policy or our data retention policies, unless a longer retention period is required by law.
Information Storage
Depending on the purpose for which the data was collected, it will be stored in any of the company’s banks or databases.
Data Origin and Subsequent Processing
In addition to the information obtained directly from the data subject, for the purpose of record-keeping, YANAPI may combine the provided information with other types of data collected through various sources, such as other users, public access data, and links from other websites.
Only if you accept the treatments described in this policy, your data may be used for the promotion of products and services; and/or be subject to transfer to suppliers, business partners, or any other company that forms part of the YANAPI economic group.
Please contact us via email at dataprotection@yanapi.com to exercise your rights as the data subject, as outlined in the Law on Personal Data Protection (LOPDP). The exercise of these rights, detailed below, will not be subject to a decision based solely on automated assessments.
Your rights are as follows:
Access: You can request access to all data and information about its processing by YANAPI without justification, as long as the request is reasonable and does not constitute an abuse of the right.
Portability: You can request that your data be delivered to you or another controller in a compatible, updated, structured, common, interoperable, and machine-readable format, preserving its characteristics, provided that the requirements of current regulations are met.
Rectification and updating: You can request YANAPI to update or modify any data that you verify as incorrect or outdated.
Please note that it is your obligation to provide accurate and truthful information. On our part, we conduct reviews and comparisons of the information you provide with public information or information available on the websites of state authorities and publicly accessible.
Deletion: You can request the deletion of your data when there is no longer a reason for its processing, when our contractual relationship has ended, or when its retention is no longer necessary for the purpose for which it was initially collected. This right, according to the law, has its limitations. We may keep your information if an authority requires it, within the framework of investigations or public interest, or if there is a legal obligation to keep it for longer than previously established.
Objection: You can object to the use of your data if you find that it is being processed for purposes other than those for which it was collected or if it is not necessary to maintain our contractual relationship.
Suspension of processing: You can request the temporary cessation of the processing of your data when:
• You challenge the accuracy of your data.
• The processing we carry out is unlawful.
• If YANAPI no longer needs to process your data, but you may need it for the formulation, exercise, or defense of claims.
• If you object to the processing of your data for the fulfillment of a mission in the public interest or for the satisfaction of a legitimate interest, while we verify if the legitimate reasons for processing prevail over those of the data subject.
Object to automated decisions: The data subject or interested party may request that an YANAPI operator provide a clear and coherent explanation of the decision of automated processing, collect their comments on it, and challenge YANAPI’s decision if necessary.
Requests must contain the following elements: (i) Names and surnames of the right holder, attaching a copy of their identity document with a photograph and, if applicable, also of their legal representative; (ii) Specific request; (iii) Address or physical/electronic address, to make the corresponding notifications; and (iv) Date and signature of the applicant (right holder/interested party).
Data Transfer
The information provided by users will be available to the data subjects or interested parties. Personal information may only be accessed by authorized individuals; likewise, its circulation will be limited to the exercise of purposes authorized by the user, without prejudice to compliance with legal and/or judicial orders requiring access to information provided by users, suppliers, workers, and contractors of YANAPI.
YANAPI may occasionally share your personal information with certain data processors acting as providers. These individuals have been previously verified not only in terms of managing the data they come across but also in complying with a confidentiality agreement for the provided information, along with a value chain of compliance with applicable regulations and anti-bribery, anti-corruption, and fraud prevention policies or procedures.
You expressly acknowledge and accept that YANAPI may transfer your received or collected data to: (i) any of the members of companies related, affiliated, controlled, controlling, subsidiaries, representations, or linked to YANAPI S.A.; (ii) third-party providers of data processing and treatment services; and (iii) other third parties that may require such data from YANAPI for a lawful purpose, for example, for audits and supervision by State regulators, as well as by administrative or judicial authorities.
Effects of Data Delivery
The information provided to YANAPI requires the free, prior, informed, and express consent of the data subject, which will be obtained through physical or electronic means, allowing it to be consulted later. The data subject commits to providing accurate and precise data; otherwise, they will be responsible for the processing of the provided information. Authorization is not required in cases of requests from public or administrative entities exercising their legal functions, publicly known data, or cases of medical or health emergencies.
If the user believes that YANAPI should not use or share their personal information, they must express this explicitly through the Data Protection Delegate, via email at proteciondedatos@yanapi.com.
Data subjects can at any time revoke the authorization granted for the processing of their data or request its deletion, as long as this is not prevented by a legal or contractual provision.
YANAPI establishes simple and free mechanisms for data subjects to revoke their authorization or request the deletion of their data, at least through the same means by which it was granted.
Consent of the Data Subject or Interested Party
YANAPI will provide the data subject or interested party with the necessary tools or means to unequivocally grant their consent regarding the processing of their data and, therefore, their compliance with this Policy.
However, this consent may be obtained by YANAPI through the acceptance of the data subject or interested party, whether verbally, physically, digitally, or through other means used by YANAPI.
Additionally, the data subject or interested party authorizes YANAPI to:
Consult and process detailed data and preferences so that YANAPI can offer its products and services optimally.
Contact the data subject or interested party to offer value propositions for products and services of YANAPI S.A. or its related companies.
Transfer or communicate data to companies related to YANAPI S.A. or business partners, for the customization of products and services to be offered to the data subject or interested party, suppliers, customers, and franchises with whom collaboration agreements, information security, and data protection agreements are maintained.
Process data automatically and incorporate the data subject of the processing into the corresponding automated personal data files of which YANAPI will be responsible.
As a guarantee of informed consent and transparency of legitimate interest, the data protection declaration will direct for more details to the privacy policy notice published on this website.
Changes to the Data Protection Policy
Updates to this document will be notified through the YANAPI website or through the digital channels we have made available to you. It is your responsibility to review them constantly. We will inform you of any details that may affect the processing of your data, without this implying a detriment to your rights as the data subject.”
Recent Comments