Privacy Policy

1. Data Controller

The data controller is Quimbaya, operating from Carrera 4 #33-45, Cartagena, Colombia. For privacy-related questions, contact us at [email protected].

2. What Personal Data We Collect

We may collect the following personal data when you submit a contact form or communicate with us:

• Full name
• Email address
• Phone number (optional)
• Company name and sector (if provided)
• Message content and any details you share about your firm's situation

We also collect anonymized technical data through cookies and analytics tools — including pages visited, session duration, and device type. This data does not identify individual users. See Section 6 and our Cookie Policy for details.

3. Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you submit a contact form, you consent to us processing your information to respond to your enquiry.
• Legitimate interest: We may use contact information to follow up on a previous conversation, where there is a reasonable expectation that this is welcome.
• Contract: Where we enter an advisory engagement, processing personal data is necessary to deliver the agreed services.

This policy operates in accordance with Colombian data protection legislation, including Ley 1581 de 2012 (Habeas Data) and its regulatory decrees. Where clients are based in other jurisdictions, we apply equivalent standards.

4. How We Use Your Data

• To respond to enquiries submitted through our contact form
• To deliver advisory services where an engagement has been agreed
• To follow up on previous conversations with your consent
• To comply with legal obligations
• To improve our website and understand how it is used (anonymized data only)

We do not use personal data for automated marketing campaigns. We do not sell or rent personal data to third parties.

5. Data Retention

Enquiry data from contact forms is retained for up to 12 months if no engagement follows. Where a service engagement occurs, relevant records are retained for 5 years for legal and professional purposes, then deleted or anonymized. You may request deletion at any time — see Section 8.

6. Cookies

Our website uses cookies for essential functionality and optional analytics. Essential cookies cannot be disabled as they are required for the site to function. Analytics and preference cookies require your consent, which you can provide or decline via the cookie notice displayed on your first visit.

For full details, please see our Cookie Policy.

7. Data Security

We use appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, or disclosure. These include:

• Secure hosting with encrypted data transmission (HTTPS)
• Access controls limiting data access to authorized personnel
• Regular review of our data handling practices

In the event of a data breach that poses a risk to individuals, we will notify the relevant supervisory authority and affected individuals in accordance with applicable law.

8. Your Rights

Under Colombian data protection law, and consistent with international standards, you have the following rights regarding your personal data:

• Access: You may request a copy of the personal data we hold about you.
• Rectification: You may request that inaccurate or incomplete data be corrected.
• Erasure: You may request that we delete your personal data, subject to legal retention requirements.
• Portability: You may request your data in a commonly used format.
• Objection: You may object to processing based on legitimate interest.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email us at [email protected]. We will respond within 15 business days.

You may also lodge a complaint with the Superintendencia de Industria y Comercio (SIC), the Colombian supervisory authority for data protection: www.sic.gov.co.

9. Third-Party Services

Our website may use third-party analytics services. Where used, these are configured to anonymize IP addresses and do not allow the identification of individual users. We do not embed third-party advertising. Links to external websites are provided for reference only — we are not responsible for the privacy practices of those sites.

10. Children's Privacy

Our services are intended for business use by adults (18 years or older). We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted information through our site, please contact us and we will delete the data promptly.

11. Changes to This Policy

We may update this policy from time to time. When we do, the "Last Updated" date at the top of this page will be revised. We encourage you to review this policy periodically. Continued use of our website after changes constitutes acceptance of the updated policy.

12. Contact for Privacy Matters

For any questions about this policy or how we handle your personal data: