Article 12. THE DATA SUBJECT'S AUTHORIZATION SHALL NOT BE REQUIRED IN THE FOLLOWING CASES:

1. Information requested by a public or administrative authority in the exercise of its legal functions or by court order.
2. Data of a public nature.
3. Medical or public health emergencies.
4. Processing of information authorized by law for historical, statistical, or scientific purposes.
5. Data related to the Civil Registry of individuals.

Article 13. PROOF OF AUTHORIZATION.

The University of Cauca shall implement the appropriate mechanisms and actions to maintain records or suitable technical or technological mechanisms documenting when and how authorization was obtained from the data subjects for the Processing of their personal data.

Article 14. PRIVACY NOTICE.

The PRIVACY NOTICE is the verbal, written, or electronic communication made available to the Data Subject to inform them of the information, existence, and means of accessing the Guidelines for the Processing of Personal Data applicable to them. At the time of collecting or capturing personal data, the University of Cauca shall implement the privacy notice in accordance with the provisions of Articles 2.2.2.25.3.2 and 2.2.2.25.3.3 of Decree 1074 of 2015 – Single Regulatory Decree for the Commerce, Industry, and Tourism Sector.

At a minimum, the privacy notice shall contain the following information:

1. Name or corporate name and contact information of the Data Controller.
2. The purpose of data collection and the type of Processing to which the data will be subject.
3. The Rights of the Data Subject.
4. The mechanisms and communication channels made available by the Data Controller so that the Data Subject may become aware of these Guidelines and exercise their Constitutional Rights.
5. If the organization or the Data Controller collects sensitive personal data, such as racial or ethnic origin, sexual orientation, political or religious affiliation, etc., the Data Subject must be informed of the sensitive nature of such information and must also be given the option to decide whether to provide such data.

For the dissemination of the privacy notice and the Guidelines for the Processing of Personal Data, the Data Controller may use documents, electronic formats, verbal means, or any other technology, provided that it guarantees and fulfills its duty to inform the Data Subject.

Article 15. RIGHTS OF THE DATA SUBJECT.

The University of Cauca guarantees the following Rights to the Data Subject:

1. To know, include, update, rectify or correct, exclude, or request the deletion of their personal data held by the University in its capacity as Data Controller. This right may be exercised, among other cases, with respect to partial, inaccurate, incomplete, fragmented, or misleading data, or data whose Processing is expressly prohibited or has not been authorized under the terms established by law.
2. To request proof of the authorization granted to the University of Cauca in its capacity as Data Controller, except where such authorization is expressly exempted as a requirement for the Processing of personal data.
3. To receive information from the University of Cauca, upon request, regarding the use made of their personal data.
4. To file complaints before the legally established authorities, especially the Superintendence of Industry and Commerce, regarding violations of the applicable regulations governing the Processing of Personal Data, after exhausting the consultation or complaint procedure before the University of Cauca in its capacity as Data Controller.
5. To modify or revoke authorization and/or request the deletion of data when the Processing fails to respect constitutional and legal principles, rights, and guarantees, or by virtue of the Data Subject's free and voluntary request. Requests for deletion of information and revocation of authorization shall not proceed when the Data Subject has a legal or contractual obligation to remain in the University of Cauca's databases.
6. To access, free of charge, the personal data subject to Processing through the channels established by the University for that purpose.

During the Processing of Personal Data, respect for the prevailing rights of minors shall be ensured. The Processing of personal data of minors is prohibited, except for data of a public nature.

It is the responsibility of the State and educational institutions of all levels to provide information and training to legal representatives and guardians regarding the potential risks minors face as a result of the improper Processing of their personal data, and to promote awareness of the responsible and secure use by children and adolescents of their personal data, as well as their right to privacy and the protection of their personal information and that of others.

Article 16. THE ABOVE-MENTIONED RIGHTS MAY BE EXERCISED BY:

1. The Data Subject, who must sufficiently prove their identity through the means made available by the University of Cauca.
2. Their successors, who must provide proof of such status.
3. The Data Subject's representative and/or attorney-in-fact, upon proof of such capacity.
4. By stipulation in favor of another person or on behalf of another person.

Article 17. DUTIES OF THE UNIVERSITY AS DATA CONTROLLER AND DATA PROCESSOR

In its capacity as both Data Controller and Data Processor, the University of Cauca shall comply with the following duties, without prejudice to the provisions established by law:

1. Guarantee the Data Subject, at all times, the full and effective exercise of the right to habeas data.
2. Request and retain a copy of the corresponding authorization granted by the Data Subject in the format in which it was recorded.
3. Properly inform the Data Subject of the purpose of data collection and the Rights granted by virtue of the authorization provided.
4. Protect and preserve the information under the security and privacy conditions necessary to prevent its alteration, loss, consultation, use, or unauthorized or fraudulent access.
5. Ensure that the information provided to the Data Processor is truthful, complete, accurate, up to date, verifiable, understandable, and consists of data whose Processing has been previously authorized in accordance with the law and these Guidelines.
6. Timely update the information by promptly informing the Data Processor of any changes regarding the data previously supplied and adopt any other necessary measures to ensure that the information remains up to date.
7. Correct inaccurate information and notify the Data Processor accordingly.
8. Provide the Data Processor, as applicable, only with data that has been previously authorized.
9. Require the Data Processor at all times to respect the security and privacy conditions applicable to the Data Subject's information.
10. Inform the Data Processor whenever certain information is under dispute by the Data Subject, once a complaint has been filed and while the corresponding procedure remains unresolved.

Article 18. PERSONS TO WHOM INFORMATION MAY BE DISCLOSED.

Information that meets the conditions established by law may be disclosed to the following persons:

1. The Data Subjects, their successors, or their legal representatives.
2. Public or administrative authorities acting within the scope of their legal functions or pursuant to a court order.
3. Third parties authorized by the Data Subject or by law.

Article 19. ENTITY RESPONSIBLE FOR THE GUIDELINES FOR THE PROCESSING OF PERSONAL DATA AND LEADER OF THE HANDLING OF CONSULTATIONS, COMPLAINTS, AND REQUESTS.

The Information and Communications Technologies (ICT) Division of the University of Cauca, in coordination with the institutional departments, shall be responsible for monitoring and coordinating the Guidelines for the Processing of Personal Data and shall lead the management of the procedure for consultations, complaints, and requests submitted by Data Subjects for the exercise of the Rights established in Law 1581 of 2012, its implementing decrees, the issued External Circulars, and any other regulations or provisions that amend, supplement, or replace them.

The Information and Communications Technologies (ICT) Division of the University of Cauca shall oversee the effective implementation of the Guidelines and procedures adopted to ensure compliance with the regulations governing the Processing of Personal Data, as well as the implementation of best management practices within the Institution, under the direction and guidance of that Division. Likewise, it shall receive, register, and assign consultations, complaints, and requests submitted by Data Subjects for the exercise of their Rights to the functional departments responsible for the Processing of Personal Data so that they may be duly resolved.

The Data Subject may, at any time, request access to the personal data registered by the University of Cauca, as well as request the correction, updating, or deletion of their personal data, revoke the authorization granted for its Processing, and, in general, exercise their Rights by submitting duly supported petitions, consultations, and complaints. For this purpose, the University of Cauca has established the following contact channels:

Correspondence Office: Single Service Window, University of Cauca
Address: Calle 5 #4-70 | Popayán, Cauca.
Email: quejasreclamos@unicauca.edu.co

Article 20. DUTIES OF DATA PROCESSORS.

Data Processors shall comply with the following duties, without prejudice to the other provisions established in these Guidelines and in the regulations governing their activities:

1. Guarantee the protection of the Data Subject's personal data at all times and the full and effective exercise of the right to Habeas Data.
2. Protect the information under the necessary security conditions to prevent its alteration, loss, consultation, use, or unauthorized or fraudulent access.
3. Timely update, correct, or delete data in accordance with these Guidelines or the applicable regulations in force.
4. Update the information reported by the Data Controllers within five (5) business days following receipt of their request.
5. Process consultations and complaints submitted by Data Subjects in accordance with the terms established by the applicable regulations.
6. Include the notation "claim in process" in the database in the manner established by the applicable regulations.
7. Include the notation "information under judicial dispute" in the database once notified by the competent authority of judicial proceedings related to the quality of the personal data.
8. Refrain from circulating information that is under dispute by the Data Subject and whose blocking has been ordered by the Superintendence of Industry and Commerce or any other competent authority.
9. Allow access to the information only to persons authorized to access it.
10. Inform the Superintendence of Industry and Commerce or the competent authority whenever security breaches occur or risks arise in the management of Data Subjects' information.
11. Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce or the competent authority in this matter.

Article 21. GUARANTEES OF THE RIGHT OF ACCESS.

The University of Cauca shall guarantee the right of access upon prior verification of the identity of the Data Subject and the legitimacy or legal capacity of their representative, by making the corresponding personal data available to them, free of charge and in a detailed and comprehensive manner, through any means, including electronic means that allow the Data Subject direct access to such data. Such access shall be provided without limitation and shall enable the Data Subject to review and update their personal data in accordance with their request through the means established by the University in compliance with these Guidelines.

Article 22. PROCEDURE FOR THE EXERCISE OF THE RIGHTS OF DATA SUBJECTS.

The Data Subject, their successors, or their representative and/or attorney-in-fact may, at any time, request access to the personal data registered by the University of Cauca, as well as request the correction, updating, or deletion of their personal data, revoke the authorization granted for its Processing, and, in general, exercise their rights by submitting consultations and complaints in accordance with the following procedure.

SUBMISSION OF THE REQUEST.

The request must be submitted through any of our service channels: in writing to the University of Cauca, located at Calle 5 #4-70 | Popayán, Cauca, or electronically via email at: quejasreclamos@unicauca.edu.co.

To process the request, complaint, or claim, the following information must be provided:

REQUEST REQUIREMENTS.

The request must include the following:

1. First and last names of the Data Subject.
2. Identification number of the Data Subject.
3. Contact information of the Data Subject.
4. Description of the facts giving rise to the consultation, complaint, or revocation request.
5. Documents deemed to support the consultation, complaint, or revocation request.
6. The preferred means of receiving the response.
7. Name of the petitioner, who, if different from the Data Subject, must attach the documents authorizing them to act on the Data Subject's behalf.
8. Signature of the petitioner.

The following considerations must be taken into account:

1. If the Data Subject acts on their own behalf, they must prove their identity by attaching a copy of their identification document and clearly and expressly stating the reason for the request.
2. If the request is submitted by a successor, they must attach a copy of their identification document, the Data Subject's death certificate, and clearly and expressly state the reason for the request.
3. If the Data Subject or their successors act through a representative or attorney-in-fact, such capacity must be duly accredited by means of a power of attorney granted by the Data Subject whose data was collected, clearly and expressly stating the reason for the request.
4. In the case of minors, their representative or guardian must submit the document proving the relationship or legal representation of the minor (birth certificate). Without this supporting document, the University shall refrain from processing the request in order to safeguard the best interests of the minor.

Article 23. REQUEST MANAGEMENT.

All requests submitted by persons entitled to exercise any of the aforementioned Rights shall be processed as follows:

1. Consultations:

Data Subjects or their successors may consult the personal information of the Data Subject contained in any database. Accordingly, the University of Cauca shall guarantee the right of consultation by providing Data Subjects with all the information contained in the individual record or associated with the identification of the Data Subject.

In all cases, regardless of the mechanism implemented for handling consultation requests, they shall be answered within a maximum period of fifteen (15) business days from the date of receipt. If it is not possible to respond within that period, the interested party shall be informed before the expiration of the fifteen (15) business days, stating the reasons for the delay and indicating the date on which the consultation will be answered, which in no case may exceed eight (8) additional business days after the expiration of the initial term.

2. Complaints:

Data Subjects or their successors who consider that the information contained in a database should be corrected, updated, or deleted, or who identify a possible breach of any of the duties established by law, may file a complaint, which shall be processed according to the following rules:

The complaint shall be submitted through a request addressed to the Data Controller or the Data Processor. In all cases, the complaint shall be addressed within a maximum period of fifteen (15) business days from the day following its receipt. If it is not possible to respond within that period, the interested party and/or the Data Subject shall be informed of the reasons for the delay and the date on which the request will be addressed, which in no case may exceed eight (8) additional business days after the expiration of the initial term.

If the request is incomplete or unclear, the interested party and/or the Data Subject shall be required, within five (5) business days following receipt of the communication, to correct or clarify the deficiencies. Once the request has been clarified, the database shall include the notation "claim in process." If two (2) months have elapsed from the date of the request for clarification and the applicant has not submitted the required information, the request shall be deemed withdrawn.

3. Data correction and updating:

The University of Cauca is required, at the request of the Data Subject, to correct and update any information that is incomplete or inaccurate, in accordance with the procedure and timeframes established above. In this regard, the following shall apply:

3.1 In requests for correction and updating of personal data, the Data Subject must specify the corrections to be made and provide the documentation supporting the request.

3.2 The University of Cauca shall have full discretion to establish mechanisms that facilitate the exercise of this right, provided that they benefit the Data Subject. Accordingly, electronic or any other appropriate means may be implemented.

3.3 The University of Cauca may establish forms, systems, and other simplified methods, which shall be communicated through the privacy notice and made available to interested parties on the institutional website.

4. Data deletion:

When requesting the deletion or removal of data from the databases, the Data Subject and/or the interested party must clearly and specifically state the reason for the request, which may simply be the Data Subject's own decision. Once the request has been received and the information verified, the University shall have a period of fifteen (15) business days following verification to proceed with the deletion and/or removal of the personal data of the Data Subject or applicant from the University of Cauca's database(s).

Once the deletion has been completed, the Data Subject or applicant shall be informed through the same channel by which the request was received, and evidence supporting the communication shall be provided.

Likewise, the Data Subject or applicant shall be informed whenever the complete deletion of personal data from the University of Cauca's databases is not possible, for example, due to academic, administrative, accounting, tax, legal, contractual, or historical information requirements, including tax obligations. Nevertheless, the requested information shall be disabled.

Without prejudice to the foregoing, should such information be required by a public authority in the exercise of its functions or by judicial order, the data shall be reactivated in order to comply with the applicable legal requirements. If the University of Cauca is not the competent entity to resolve a complaint, it shall forward the complaint to the appropriate authority within a maximum of two (2) business days. If the new responsible entity can be identified, the interested party shall be informed so that they may follow up on the matter or clearly identify the entity to which the request should be directed.

The Data Subject has the right, at any time, to request that the University of Cauca delete (remove) their personal data when:

1. They consider that the data are not being processed in accordance with the principles, duties, and obligations established in the applicable regulations.
2. The data are no longer necessary or relevant for the purpose for which they were collected.
3. The period necessary to fulfill the purposes for which the data were collected has expired.

Sole Paragraph: Such deletion implies the total or partial removal of personal information, as requested by the Data Subject, from the records, files, databases, or Processing activities carried out by the University of Cauca. It is important to note that the right to deletion is not absolute, and the Data Controller may deny its exercise when:

1. The Data Subject has a legal or contractual obligation to remain in the database.
2. The deletion of the data would hinder judicial or administrative proceedings related to tax obligations, the investigation and prosecution of criminal offenses, or the enforcement of administrative sanctions.
3. The data are necessary to protect the legally protected interests of the Data Subject, to carry out an action in the public interest, or to comply with a legal obligation undertaken by the Data Subject.

With respect to audiovisual content (photographs, videos, or voice recordings) published on institutional digital channels or social media, the Data Subject or their representative may request its immediate removal. The University shall proceed with the de-indexing or removal of the content within a period not exceeding ten (10) business days following validation of the request, informing the Data Subject of the limitations on controlling such content once it has been shared by third parties unrelated to the institution.

Article 24. REVOCATION OF AUTHORIZATION:

Data Subjects may revoke their consent to the Processing of their personal data at any time, provided that such revocation is not prevented by a legal or contractual provision. For this purpose, the University of Cauca shall establish simple and free mechanisms that allow the Data Subject to revoke their consent, at least through the same means by which it was granted. It should be noted that there are two (2) forms of revocation of consent:

1. Total revocation: This may apply to all the purposes for which consent was granted, meaning that the University of Cauca must completely cease Processing the Data Subject's personal data.
2. Partial revocation: This may apply to specific types of Processing, such as for advertising or market research purposes. In the case of partial revocation, the remaining purposes of Processing that the Data Controller is authorized to carry out under the granted authorization, and with which the Data Subject agrees, shall remain unaffected.

Article 25. SECURITY MEASURES FOR THE PROTECTION AND PRIVACY OF INFORMATION.

The University of Cauca is committed to adopting the security measures established by the Superintendence of Industry and Commerce in accordance with Article 2.2.2.25.3.7 of Decree 1074 of 2015 – Single Regulatory Decree for the Commerce, Industry, and Tourism Sector, regarding the Processing of Personal Data. Notwithstanding the foregoing, as part of its continuous improvement process, the University of Cauca shall establish controls that, to the extent possible, preserve information and its contents in order to limit access by unauthorized third parties.

The ICT Division, in coordination with the Communications Management Center and the Legal Office, shall conduct technical audits and compliance reviews of these Guidelines at least once a year. These controls shall evaluate the effectiveness of encryption measures, access logs, and the integrity of the databases, producing continuous improvement reports to mitigate security risks.

Article 26. INTERNATIONAL TRANSFER AND TRANSMISSION OF PERSONAL DATA.

In fulfillment of its institutional mission of teaching, research, and extension, and considering its permanent or occasional academic and administrative relationships, the University of Cauca may transfer and/or transmit the personal data of Data Subjects to third parties with whom it maintains contractual, cooperative, or operational relationships that enable it to properly fulfill its legal functions. For this purpose, the necessary measures shall be adopted to ensure that any persons granted access to personal data comply with these Guidelines for the Processing of Personal Data and with the obligations established by law.

For the Transfer of Personal Data, the provisions of Article 26 of Law 1581 of 2012 and its implementing regulations shall apply.

For the Transmission of Personal Data, contractual clauses shall be established or a Personal Data Transmission Agreement shall be executed specifying:

1. The scope of the Processing.
2. The activities that the Data Processor shall perform on behalf of the Data Controller for the Processing of personal data.
3. The obligations of the Data Processor toward the Data Subject and the Data Controller.

Through such agreement, the Data Processor shall undertake to comply with the obligations of the Data Controller under these Guidelines for the Processing of Personal Data and to process the data in accordance with the purposes authorized by the Data Subjects and the applicable laws in force.

Sole Paragraph: In addition to the obligations imposed by the applicable regulations within the aforementioned agreement, the following obligations shall also be imposed upon the respective Data Processor:

1. Process personal data on behalf of the Data Controller in accordance with the principles governing such Processing.
2. Safeguard the security of the databases containing personal data.
3. Maintain the confidentiality of the Processing of personal data.

International transmissions of personal data carried out by the University of Cauca shall not require notification to the Data Subject or their consent when a Personal Data Transmission Agreement exists in accordance with Article 2.2.2.25.5.2 of Decree 1074 of 2015 – Single Regulatory Decree for the Commerce, Industry, and Tourism Sector.

Article 27. DATA CATEGORIZATION. ESSENTIAL DATA.

The University classifies the following personal data as essential for the provision of educational and complementary services.

1. Student records and family data.

1. General data regarding the student and their family that the University is required to collect (first and last names; identification document number; residential address; health insurance affiliation; first and last names and address of parents or guardians).
2. The student's academic records and academic and disciplinary file that the University is required by law to collect and process (partial and final grades by semester and course, records of disciplinary proceedings, dates of admission to the University).
3. Sensitive personal data regarding the student and their family that the University is required by law to collect and process (blood type, disabilities).

2. Data for support services.

1. Sensitive data required by the University to provide students with prompt and effective assistance in emergency situations, as well as the data required by law for the creation of medical records (chronic illnesses, required medications, treatment protocols, family emergency contact telephone number).
2. Sensitive personal data arising in connection with the services provided by the Vice-Rectorate for University Well-being, as well as the information contained in the corresponding forms.
3. Personal data required by the University to offer and develop extracurricular activities and cultural and sports events.

3. Contractual and accounting data.

1. Accounting data required by the University to calculate tuition fees (personal identification information, socioeconomic status, income).
2. The accounting and financial personal data of families arising from their contractual obligations with the University (tuition payments).

4. Personnel and payroll data.

1. The general personal data required by the University from its employees and the data generated as a result of the employment relationship, such as salary information, performance evaluations, and aptitude test results.
2. The personal data required by the University to maintain employee payroll accounting records.
3. Sensitive personal data related to occupational health and labor disputes.
4. Sensitive personal data related to the work carried out by the Workplace Coexistence Committee and the Occupational Health Committee, among others.

5. Supplier and contractor data.

The general personal data required by the University to enter into contracts with third parties and to carry out outsourced activities (the contracts themselves, the personal identification information required for the contract, and, where applicable, the specific characteristics of the contracted service).

6. Data of individuals for research and extension purposes.

The personal data required by the University to carry out research and extension projects involving natural persons who are the subject of such projects.

Article 28. NATIONAL PERSONAL DATA DATABASE REGISTRY.

The University of Cauca hereby informs that it complies with Decree 090 of January 18, 2018, specifically Article 2.2.2.26.1.2, "Scope of Application," which provides that the National Database Registry shall include databases containing personal data whose automated or manual Processing is carried out by Data Controllers meeting the following characteristics: "...b) Public legal entities"; as well as Article 2.2.2.26.3.1, "Registration Deadline," paragraph (c), which establishes that "Data Controllers that are public legal entities shall complete the registration no later than January 31, 2019, in accordance with the instructions issued by the Superintendence of Industry and Commerce." Likewise, in compliance with Article 2.2.2.25.2.8 of Decree 1074 of 2015 – Single Regulatory Decree for the Commerce, Industry, and Tourism Sector, personal data may only be collected, stored, used, or circulated for the period that is reasonable and necessary in accordance with the purposes that justified their Processing, taking into account the applicable provisions governing the relevant subject matter, as well as the administrative, accounting, tax, legal, and historical aspects of the information.

The National Database Registry (RNBD) is the public directory of databases subject to Processing operating within the country and shall be freely accessible to citizens in accordance with the regulations issued for that purpose by the National Government.

Article 29. EFFECTIVE DATE.

This Resolution shall become effective as of the date of its issuance and repeals all provisions contrary to it.

Article 30. COMMUNICATION AND DISSEMINATION.

Communicate this Resolution to the entire University community through the institutional website of the University of Cauca in order to ensure its awareness, dissemination, and application in all processes related to the Processing of Personal Data.

LET IT BE COMMUNICATED, PUBLISHED, AND ENFORCED

Issued in Popayán, on the twenty-seventh (27th) day of May, 2026.

DEIBAR RENÉ HURTADO HERRERA
Rector

Prepared and reviewed by: Juan Pablo Pino López – Specialized Professional, Information and Communications Technologies Division.
Approved by: Pablo Zambrano Simmonds – Head of the Legal Advisory Office.