Privacy Policy and Personal Data Processing

1. Introduction and purpose

Henao Pinilla Inversiones SAS (hereinafter “the Company”, “we” or “Henao Pinilla”) is a Colombian company that provides information technology services, process automation, software development and digital marketing.

This Privacy Policy describes how we collect, use, store, protect and share the personal data of people who interact with our website, contact us or hire our services. We are committed to handling all personal information in an ethical, transparent and professional manner, and to complying with the applicable regulations in the jurisdictions where we operate.

By using our website or hiring our services, you accept this Policy. If you do not agree with its terms, please refrain from using our services and contact us at [email protected] to resolve any questions.

2. Applicable legal framework

This Policy is governed by and complies with the following legal frameworks, depending on the location and nationality of the data subject:

2.1 Colombia

• Statutory Law 1581 of 2012 — General Personal Data Protection Regime.
• Regulatory Decree 1377 of 2013 and other supplementary decrees.
• External Circular 002 of 2015 issued by the Superintendence of Industry and Commerce (SIC).

2.2 European Union and European Economic Area

• General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
• ePrivacy Directive 2002/58/EC (Cookie Directive).

2.3 United States

• California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) — applicable to residents of the State of California.
• Children’s Online Privacy Protection Act (COPPA) — applicable to children under 13 (see section 10).

2.4 Other reference frameworks

• Lei Geral de Proteção de Dados Pessoais (LGPD) — Brazilian Law 13.709/2018.
• OECD Privacy Principles.
• ISO/IEC 27001 and ISO/IEC 27701 standards as reference frameworks for information security and privacy.

3. Data controller

The controller of your personal data is:

Company name: Henao Pinilla Inversiones SAS
Tax ID (NIT): 901.279.650-4
Registered address: Bogotá D.C., Colombia
Email: [email protected]
Website: www.henaopinilla.com

For GDPR purposes, Henao Pinilla acts as the data controller. When we provide automation or data management services on behalf of our clients, we may act as a data processor, in which case the corresponding Data Processing Agreement will be signed.

4. Personal data we collect

4.1 Data you provide directly

• First and last name.
• Email address.
• Phone or WhatsApp number.
• Company name and tax ID (NIT/RUT), where applicable.
• Job title or role within the organization.
• Information contained in messages, inquiries or quote requests.

4.2 Data collected automatically

• IP address and approximate geolocation data.
• Browser type, operating system and device.
• Pages visited, time on page and navigation paths.
• Traffic source (search engine, social network, direct link).
• Behavior and interaction data on the website (clicks, cursor movements, anonymized session recordings).

4.3 Data from third parties

We may receive data about you through advertising platforms (Meta Ads, Google Ads) when you interact with our ads on those platforms, in accordance with their own privacy policies.

5. Purposes of processing

Your personal data is processed solely and exclusively for the following purposes:

5.1 Main purposes

• Responding to contact requests, quote requests and inquiries about our services.
• Managing the contractual relationship with clients and suppliers.
• Sending commercial proposals, quotes and documentation related to the contracted services.
• Issuing invoices, managing payments and meeting tax and accounting obligations.
• Providing the contracted technical support, automation and digital marketing services.

5.2 Secondary purposes (with consent)

• Sending commercial communications, newsletters and useful content about technology and digital transformation.
• Conducting satisfaction surveys and market research.
• Showing personalized advertising through Meta Ads and Google Ads.

5.3 Analytics and improvement purposes

• Measuring website performance and user behavior to improve the browsing experience.
• Analyzing traffic sources and the effectiveness of advertising campaigns.
• Detecting and fixing technical errors on the website.

6. Legal basis for processing

For each processing activity, we rely on at least one of the following legal bases:

• Performance of a contract: when processing is necessary to provide the contracted service or to take pre-contractual steps at the data subject’s request (Art. 6(1)(b) GDPR).
• Compliance with legal obligations: when we must process data to meet applicable tax, accounting or legal obligations (Art. 6(1)(c) GDPR; Art. 10 of Law 1581/2012).
• Legitimate interest: when processing is necessary for our legitimate interests, such as the security of our systems, fraud prevention or improving our services, provided the data subject’s rights do not override them (Art. 6(1)(f) GDPR).
• Consent: for commercial communications, non-essential cookies and behavioral analytics. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal (Art. 6(1)(a) GDPR; Art. 9 of Law 1581/2012).

7. Cookies and tracking technologies

7.1 What are cookies?

Cookies are small text files stored on your device when you visit our website. They allow us to remember your preferences and collect information about your browsing.

7.2 Cookies we use

Google Analytics (Google LLC): a web analytics tool that tells us the number of visitors, the most visited pages, session duration and traffic sources. The data is anonymized and processed on Google’s servers. Privacy policy: policies.google.com/privacy.

Meta Pixel (Meta Platforms, Inc.): code that lets us measure the effectiveness of our Facebook and Instagram campaigns, build custom audiences and show relevant ads to people who have visited our website. Privacy policy: facebook.com/policy.

Microsoft Clarity (Microsoft Corporation): a behavioral analytics tool that generates heatmaps and anonymized session recordings to understand how users interact with the website. Recordings do not capture sensitive information or passwords. Privacy policy: privacy.microsoft.com.

You can find details on every cookie in our Cookie Policy.

7.3 Managing cookies

When you visit our website, you will see a cookie notice that lets you accept, reject or customize their use. You can change your preferences at any time through the “Manage consent” link in the footer.

You can also disable cookies in your browser settings. Please note that disabling some cookies may affect how the website works.

8. Data transfers and disclosures

8.1 Data processors

To provide our services, we share data with providers that act as data processors under our instructions and with appropriate contractual safeguards:

• Google LLC (Google Workspace, Google Analytics, Google Ads) — United States.
• Meta Platforms, Inc. (Meta Ads, WhatsApp Business API) — United States.
• Microsoft Corporation (Microsoft Clarity, Microsoft 365) — United States.
• The website’s hosting and cloud services provider.
• Automation tools (n8n and platforms integrated as required by each project).

8.2 Safeguards for international transfers

When we transfer data to countries that do not offer a level of protection equivalent to Colombian or European standards, we apply the following safeguards:

• Standard Contractual Clauses approved by the European Commission (for transfers from the EEA).
• EU–U.S. Data Privacy Framework, when the recipient is certified.
• Express authorization from the data subject, when the above safeguards do not apply.

8.3 No sale of data

Henao Pinilla does not sell, rent or transfer personal data to third parties for those third parties’ own commercial purposes. Any disclosure of data is made exclusively in the course of providing our services and with the safeguards described in this section.

9. Data subject rights

You may exercise the following rights over your personal data at any time and free of charge:

9.1 Rights under Colombian law (Law 1581/2012)

• Know, update and correct your personal data.
• Request proof of the authorization granted for processing.
• Be informed about how your data has been used.
• File complaints with the Superintendence of Industry and Commerce (SIC) for violations of data protection regulations.
• Revoke your authorization and/or request deletion of your data when there is no legal or contractual obligation to keep it.
• Access, free of charge, your personal data that has been processed.

9.2 Rights under EU law (GDPR)

• Right of access (Art. 15): obtain confirmation of whether we process your data and access it.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure, or “right to be forgotten” (Art. 17): request deletion of your data when it is no longer necessary.
• Right to restriction of processing (Art. 18): restrict processing in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, commonly used format.
• Right to object (Art. 21): object to processing based on legitimate interest or for direct marketing purposes.
• Right not to be subject to automated decision-making (Art. 22).
• Right to lodge a complaint with the supervisory authority in your country (e.g., the AEPD in Spain or the ICO in the United Kingdom).

9.3 Rights under California law (CCPA/CPRA)

• Right to know what personal data is collected, used, shared or sold.
• Right to delete the personal data collected.
• Right to correct inaccurate personal data.
• Right to opt out of the sale or sharing of personal data.
• Right to non-discrimination for exercising your privacy rights.

9.4 How to exercise your rights

To exercise any of the rights above, send a request to [email protected] with the subject “ARCO Rights” or “Privacy”, stating your full name, the right you wish to exercise and, if possible, a copy of your identity document. We will respond within a maximum of ten (10) business days for requests under Colombian law and thirty (30) calendar days for requests under the GDPR.

10. Protection of minors’ data

Our services are intended exclusively for people over 18 years of age. We do not knowingly collect personal data from minors. If you believe we have collected data from a minor without the required parental consent, please contact us immediately at [email protected] so we can delete it.

11. Information security

We implement appropriate technical, organizational and administrative measures to protect your personal data against unauthorized access, loss, destruction or alteration. These measures include:

• Encrypted communications over HTTPS/TLS across the entire website.
• Role-based access control for internal systems that contain personal data.
• Internal policies for the confidential handling of client information.
• Periodic review of access rights and of the providers with whom data is shared.
• Confidentiality commitments from staff who have access to personal data.

Despite these measures, no method of transmitting data over the internet is 100% secure. In the event of a security breach affecting your data, we will notify you in accordance with the deadlines and requirements set by the applicable regulations.

12. Data retention

We keep your personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations:

• Active client data: for the duration of the contractual relationship.
• Inactive client data: up to ten (10) years from the last interaction, to comply with Colombian tax and accounting obligations.
• Contact and prospect data: up to two (2) years from the last contact, or until the data subject withdraws consent.
• Analytics data (cookies): according to the periods set by each tool (Google Analytics: up to 14 months; Meta Pixel: up to 180 days; Microsoft Clarity: up to 13 months).

Once these periods expire, the data will be securely deleted or anonymized.

13. Updates to this Policy

Henao Pinilla reserves the right to modify this Privacy Policy at any time to reflect changes in legislation, case law or our data processing practices. Any changes will be published on this page with the date of the last update. For substantial changes, we will notify data subjects by email when we have their address.

We recommend that you review this Policy periodically. Continued use of the website after changes are published constitutes acceptance of them.

14. Contact and data subject support

For any question, request or complaint related to the processing of your personal data, you can contact us through the following channels:

Email: [email protected]
Suggested subject: “Privacy and personal data”
Website: www.henaopinilla.com
Business hours: Monday to Friday, 8:00 a.m. – 5:00 p.m., and Saturday, 8:00 a.m. – 12:00 p.m. (Colombia time, UTC−5)

If your request is not resolved satisfactorily, you have the right to file a complaint with:

• Superintendence of Industry and Commerce (SIC) — www.sic.gov.co — for data subjects in Colombia.
• The data protection authority in your country of residence — for data subjects in the European Union or the United Kingdom.
• California Privacy Protection Agency (CPPA) — for residents of California, USA.