Personal Data Processing Policy

1. Data controller

2. Legal framework and definitions

This policy follows Article 15 of the Colombian Constitution, Statutory Law 1581 of 2012, Decree 1074 of 2015 (Book 2, Part 2, Title 2, Chapter 25, which includes Decree 1377 of 2013) and guidance from the Superintendence of Industry and Commerce (SIC). Personal data is any information linked to an identified or identifiable individual. Sensitive data is data that affects privacy or could lead to discrimination, such as health data, sex life, racial or ethnic origin, religious or political beliefs, and biometric data. The data subject is the person the data relates to. A processor handles data on the controller's behalf. Authorization is the data subject's prior, express and informed consent.

3. Principles

Processing follows the principles of legality, purpose limitation, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality (Article 4, Law 1581 of 2012).

4. Data we collect

• Identification data: name, ID or passport number and copy, nationality, date of birth.
• Contact data: phone, WhatsApp, email, home address.
• Immigration and document data: visas, permits, cédula de extranjería, apostilles, background certificates, civil registry records.
• Family and marital data: information about a spouse or permanent partner, children (including minors), marriages, unions and civil registry records.
• Health data (sensitive): medical appointments, EPS or prepaid health plan, referrals, diagnoses, results or prescriptions, only when you ask for medical accompaniment or interpreting.
• Financial and commercial data: payment and billing details, details of properties you are searching for or buying, and bank account information when you ask for help opening an account.
• Data about client businesses and their staff, when we provide admin or HR support. In that case the client is the controller and Puente Bogotá acts as a processor.
• Communications: WhatsApp messages, emails and call notes.

5. Purposes

1. Answering enquiries and sending quotes.
2. Providing the services you hire: paperwork and document support, appointment booking, in-person accompaniment, interpreting and translation, housing search, property purchase support, virtual assistance and admin support.
3. Sharing only the information that is strictly necessary with third parties when you ask us to or the service requires it: public bodies (for example Migración Colombia, Cancillería, Registraduría, notaries), licensed attorneys, official translators, real estate agents, banks, clinics and healthcare providers.
4. Billing, collecting payment, bookkeeping, and meeting tax and legal obligations.
5. Handling requests, complaints, claims and warranty matters, including consumer rights.
6. Sending reminders and messages about the service you hired.
7. Sending information about new services, only if you expressly opt in. You can withdraw that consent at any time.

6. Sensitive data

Medical accompaniment and family-related services may involve sensitive data. You are not required to authorize the processing of sensitive data or to answer questions about it (Article 6, Law 1581). If you don't provide it, we may not be able to provide some services. We will ask for your explicit authorization and tell you which data is sensitive and why we need it. Health data is used only for the appointment or task you request, is shared only with the healthcare provider or body you indicate, and is deleted once it is no longer needed.

7. Children's and adolescents' data

Family matters (for example civil registry records, passports, travel permits or medical appointments) may require processing a minor's data. This processing respects the best interests of the child and their fundamental rights (Article 7, Law 1581; Article 2.2.2.25.2.9, Decree 1074 of 2015). It requires authorization from a parent or legal representative and is limited to the purpose of the requested task. Where possible, the child's opinion is taken into account, in line with their maturity, autonomy and understanding.

8. Your rights

Under Article 8 of Law 1581 you have the right to: know and access your data free of charge; update and rectify it; request proof of your authorization; be told how your data has been used; revoke your authorization and/or request deletion of your data, unless we have a legal or contractual duty to keep it; and file complaints with the SIC once you have gone through the enquiry or claim procedure with us (Article 16).

9. Enquiries and claims procedure

Write to puentebogota@gmail.com or WhatsApp +57 311 348 5952. Include your name, ID number, contact details, a description of your request and any supporting documents. Your heirs, representative or attorney-in-fact can also make the request if they show their standing.

• Enquiries: answered within 10 business days of receipt. If we need more time, we will tell you why and when you'll get an answer, which will be no more than 5 additional business days (Article 14).
• Claims (correction, update, deletion or breach): if a claim is incomplete, we will ask you to complete it within 5 business days of receiving it. If 2 months pass without the missing information, the claim is considered withdrawn. Within 2 business days of receiving a complete claim, we mark the record as “claim in progress”. We answer within 15 business days from the day after receipt, with a possible extension of up to 8 business days if we explain why (Article 15).

10. Processors and international transfers

We use technology providers that may store data outside Colombia: Google LLC (Gmail and cloud storage), WhatsApp/Meta Platforms (messaging) and the VPS provider that hosts this website. By giving your authorization, you expressly consent to the transmission and/or international transfer of your data to these providers (Article 26, Law 1581; Article 2.2.2.25.5.1 et seq., Decree 1074 of 2015). When a service requires it, for example support with a consular procedure, data may be sent to the relevant foreign authority, always at your request.

11. Security and retention

We use reasonable technical, human and administrative safeguards: restricted access, passwords and two-step verification on accounts, an encrypted (HTTPS) connection to this website, and secure deletion of copies we no longer need. We keep data for as long as the service relationship lasts, plus any extra time needed for legal, accounting or tax obligations or to handle claims. After that it is deleted or anonymized.

12. National Database Registry

Under Decree 090 of 2018, registration in the SIC's National Database Registry (RNBD) is required only for companies and non-profits with assets above 100,000 UVT and for public-law entities. As an individual, the controller is not currently required to register, and will do so if that changes.

13. Supervisory authority

The Superintendence of Industry and Commerce (SIC), Delegation for the Protection of Personal Data: www.sic.gov.co.

14. Effective date and changes

This policy takes effect on publication in November 2026. Databases will be kept for as long as needed for the purposes above. Any material change will be announced on this website, and by email or WhatsApp where appropriate, before it applies.

Last updated: November 2026 · Puente Bogotá · Leida Milena Romero González · Cra. 50a #123a-48, Bogotá D.C., Colombia · puentebogota@gmail.com · +57 311 348 5952