1. Who We Are
Data controller: Chibcha, Carrera 15 #88-21, Bogotá, Colombia.
Contact for privacy matters: [email protected]
2. What Data We Collect
We may collect the following categories of personal data:
- Identification data: full name.
- Contact data: email address, telephone number.
- Business data: company name, role, and information about your business that you share during an engagement.
- Financial data: financial statements and reports you provide for advisory purposes. This is treated as highly sensitive and handled under strict confidentiality.
- Technical data: IP address, browser type, pages visited, and time on site — collected via cookies and analytics tools if you have consented.
- Communications: the content of emails or messages you send us.
We do not collect special-category personal data (health, ethnic origin, political opinions, etc.) and do not request it.
3. How We Collect Data
- Directly from you via the contact form on our website.
- Through email or telephone correspondence you initiate.
- During advisory sessions or engagements, where you share business and financial information.
- Automatically, via cookies and analytics tools (only with your prior consent).
4. Legal Basis for Processing
Under Colombian law (Ley 1581 de 2012), we process personal data on the following bases:
- Consent: for marketing communications and non-essential cookies. You may withdraw consent at any time.
- Contract performance: to deliver the advisory service you have engaged us for.
- Legitimate interest: to respond to enquiries, improve our services, and maintain client records.
- Legal obligation: to comply with Colombian tax and commercial law.
5. How We Use Personal Data
- To respond to enquiries and schedule introductory calls.
- To deliver contracted advisory services.
- To produce and send written summaries and engagement documents.
- To send service-related communications (session reminders, summary delivery).
- To analyse website usage and improve user experience (with consent).
- To comply with accounting, tax, and legal obligations.
We do not use personal data for automated decision-making or profiling.
6. Data Sharing
We do not sell, rent, or trade personal data. We may share data in the following limited circumstances:
- Service providers: email and cloud storage providers who process data on our behalf under data processing agreements. These providers are not permitted to use data for their own purposes.
- Legal obligations: where required by Colombian law or by order of a competent authority.
- Business transfers: in the event of a merger or acquisition, personal data may transfer to the successor entity, subject to the same protections.
Financial information shared during engagements is held in strict confidence and not shared with any third party without your explicit written consent.
7. Retention Periods
- Contact enquiries (no engagement): 12 months from last contact.
- Client engagement records: 5 years after the engagement closes, in compliance with Colombian commercial recordkeeping requirements.
- Financial documents shared for advisory purposes: deleted or returned at the end of the engagement unless retained by agreement.
- Analytics data: up to 14 months, in accordance with Google Analytics default settings.
8. Data Security
We take reasonable technical and organisational measures to protect personal data from unauthorised access, disclosure, or loss, including:
- Encrypted email and file transfer for sensitive documents.
- Access controls limiting data to staff with a need to handle it.
- Secure cloud storage with access logging.
- Prompt notification to affected individuals and the Superintendencia de Industria y Comercio (SIC) in the event of a data breach that poses significant risk.
9. Cookies
We use cookies on this website. Essential cookies are necessary for the site to function. Analytics and preference cookies are only placed with your consent. You may change your cookie preferences at any time via our Cookie Policy page.
10. Your Rights
Under Colombian Ley 1581 de 2012, you have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate or incomplete data.
- Erasure: request deletion of your data where there is no lawful reason to retain it.
- Objection: object to processing based on legitimate interest.
- Withdrawal of consent: withdraw consent at any time for processing based on consent. This does not affect prior processing.
- Complaint: lodge a complaint with the Superintendencia de Industria y Comercio (SIC), the Colombian data protection supervisory authority, at www.sic.gov.co.
To exercise any of these rights, write to [email protected]. We will respond within 15 business days in accordance with Colombian law.
11. Third-Party Links
Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend reviewing their policies before sharing personal data with them.
12. Children's Privacy
Our services are directed at business owners and professional users aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that personal data from a person under 18 has been collected, we will delete it promptly.
13. International Data Transfers
If your data is processed outside Colombia (for example, by cloud service providers with servers in the United States or Europe), we ensure appropriate safeguards are in place, such as standard contractual clauses or providers certified under equivalent frameworks.
14. Changes to This Policy
We may update this policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this page periodically. If changes are material, we will notify active clients by email.
15. Contact
For any questions about this policy or your personal data, contact us at:
- Email: [email protected]
- Address: Carrera 15 #88-21, Bogotá, Colombia
- Phone: +57 318 462 9075