Personal data processing policy

Effective date: 28/09/2023 · Last updated: 28/09/2026

1. Identification of the data controller

Company name: ADVISA INTERNATIONAL

Trade name: Advisa International

Address: Medellín, Antioquia, Colombia

Email: gestion@advisainternational.com

Telephone / WhatsApp: +57 324 402 17 92

For the purposes of this Policy, ADVISA INTERNATIONAL acts as the Data Controller of the personal data it collects, stores, uses, consults, updates, circulates or deletes in the course of its activities.

Advisa International is the trade name under which legal, wealth, real estate, corporate, immigration and consular advisory and support activities are carried out.

2. Regulatory framework

This Policy is adopted in compliance with the Colombian regulations applicable to personal data protection, especially:

• Article 15 of the Political Constitution of Colombia.
• Law 1581 of 2012.
• Decree 1377 of 2013, to the extent it remains in force and is applicable.
• Sole Regulatory Decree 1074 of 2015, with respect to personal data protection.
• Any other regulations that amend, supplement, regulate or replace them.

This Policy shall be interpreted in accordance with current regulations and with the applicable instructions and criteria of the Superintendence of Industry and Commerce (SIC).

3. Scope of application

This Policy applies to the processing of personal data carried out by Advisa International, either directly or through third parties acting as Data Processors, with respect to:

• Clients and prospective clients.
• Website users.
• Persons who request consultations or advisory services.
• Persons who complete contact forms or requests.
• Suppliers and contractors.
• Business partners.
• Employees and collaborators, where applicable.
• Persons related to the contracted services, when necessary and legally appropriate.

4. Definitions

For the purposes of this Policy, the definitions established in the applicable Colombian regulations are adopted, including:

Authorization: Prior, express and informed consent of the Data Subject to carry out the Processing of his or her personal data.

Privacy Notice: Communication addressed to the Data Subject informing him or her of the existence of the Information Processing Policy, how to access it and the purposes of the Processing.

Database: Organized set of personal data that is subject to Processing.

Personal Data: Any information linked or that may be associated with one or more identified or identifiable natural persons.

Sensitive Data: Data that affects the privacy of the Data Subject or whose improper use may lead to discrimination, in accordance with applicable law.

Data Processor: Natural person or legal entity that carries out the Processing of personal data on behalf of the Data Controller.

Data Controller: Natural person or legal entity that decides on the Database and/or the Processing of the data.

Data Subject: Natural person whose personal data is subject to Processing.

Processing: Any operation performed on personal data, such as collection, storage, use, circulation, consultation, updating, modification or deletion.

5. Principles of processing

Advisa International shall carry out the Processing of personal data in observance of the principles established in the applicable regulations, especially:

• Legality.
• Purpose.
• Freedom.
• Truthfulness or quality.
• Transparency.
• Restricted access and circulation.
• Security.
• Confidentiality.

Data shall be processed solely for legitimate, specific and explicit purposes related to the activities of Advisa International.

6. Purposes of the processing

Personal data may be processed, as applicable to each relationship and service, for the following purposes:

6.1. Customer service and contact

• Respond to requests made through the website, email, telephone, WhatsApp or other enabled channels.
• Respond to general inquiries and requests for advice.
• Coordinate meetings, consultations and appointments.
• Prepare quotations and service proposals.

6.2. Provision of services

• Perform the services contracted by the Data Subject.
• Analyze the information necessary to provide legal, wealth, real estate, corporate, immigration or consular advice.
• Prepare, review and manage documents related to the contracted service.
• Follow up on proceedings and requests.
• Maintain communication with the client during the provision of the service.
• Comply with the obligations arising from the contractual relationship.

6.3. Administrative and contractual management

• Manage payments, invoicing, accounting and tax obligations.
• Manage relationships with clients, suppliers, contractors and partners.
• Handle requests, petitions, complaints and claims.
• Keep records of commercial and contractual relationships.

6.4. Security and compliance

• Prevent fraud, misuse and unauthorized access.
• Protect the security of information.
• Comply with legal, judicial, administrative or regulatory obligations.
• Respond to requests from competent authorities when there is a legal obligation to do so.

6.5. Commercial communications

When the corresponding authorization exists, the data may be used to:

• Send information about the services of Advisa International.
• Communicate news, content or information of interest.
• Carry out marketing and commercial communication activities.
• Request feedback on the service experience.

The Data Subject may request at any time that commercial communications cease, without affecting the processing necessary for the provision of a contracted service or the fulfillment of legal obligations.

7. Processing of sensitive data

Advisa International may come across information that is sensitive in nature or that requires special protection, depending on the nature of the contracted service.

This may occur, among other cases, when the performance of a service requires documents related to:

• Health information.
• Biometric information.
• Information concerning minors.
• Financial or wealth information.
• Information related to judicial or administrative proceedings.
• Immigration or consular information.
• Identity documents and other official documents.

Advisa International shall process such information only when there is a legal basis for doing so and when it is necessary, relevant and proportionate to the corresponding purpose.

When the law requires authorization for the processing of sensitive data, such authorization shall be requested in accordance with the applicable regulations.

The Data Subject is not required to provide sensitive data, except when a legal provision establishes otherwise or when such data is strictly necessary for the provision of a requested service, in which case the Data Subject shall be informed of such circumstance.

8. Processing of data of children and adolescents

When the provision of a service involves the processing of personal data of children or adolescents, Advisa International shall act in accordance with the applicable regulations, with the protection of their rights and interests as its paramount criterion.

Where applicable, the authorization of the person exercising legal representation shall be requested and the minor's right to be heard shall be guaranteed, in accordance with his or her maturity and other applicable circumstances.

9. Rights of data subjects

In accordance with applicable law, the Data Subject has the right to:

1. Access, update and rectify his or her personal data.

2. Request proof of the authorization granted, except for the exceptions provided by law.

3. Be informed about the use that has been made of his or her personal data.

4. Submit inquiries and claims to the Data Controller or Data Processor.

5. Request the deletion of his or her data when legally appropriate.

6. Revoke the authorization when appropriate.

7. Access, free of charge, his or her personal data subject to Processing.

8. File with the Superintendence of Industry and Commerce such complaints as he or she deems appropriate once the inquiry or claim procedure before the Data Controller or Data Processor has been exhausted, when this is required.

The exercise of these rights shall be subject to the exceptions and limitations established in current legislation.

10. Procedure for inquiries and claims

The Data Subject may exercise his or her rights through a communication addressed to:

Email: gestion@advisainternational.com

WhatsApp: +57 324 402 17 92

The request must contain, at a minimum:

• Name and identification of the Data Subject.
• Description of the request.
• Contact details for receiving a response.
• Documents supporting the request, when necessary.

When the request is submitted by a representative, such representation must be evidenced in accordance with the applicable regulations.

Inquiries

Inquiries shall be addressed within the maximum time limit established by current legislation.

Currently, inquiries must be addressed within ten (10) business days following their receipt. When it is not possible to respond within such time limit, the interested party shall be informed of the reason for the delay and the date on which the inquiry will be addressed, without exceeding the additional time limit legally permitted.

Claims

Claims shall be addressed within the maximum time limit established by current legislation.

Currently, the general time limit is fifteen (15) business days counted from the day following the date of receipt of the claim. When it is not possible to resolve it within such time limit, the reasons for the delay and the date of response shall be communicated, within the additional time limit permitted by law.

11. Data processors and third parties

In carrying out its activities, Advisa International may rely on suppliers and third parties that require access to certain personal data, provided that this is necessary for the provision of services, administrative management, storage, communications, security, technology or other legitimate purposes.

When these third parties act as Data Processors, the corresponding obligations regarding the protection, confidentiality and security of the information shall be established.

Advisa International shall endeavor to ensure that the third parties entrusted with the Processing adopt adequate measures to protect personal data.

12. Transmission and transfer of data

When necessary for the provision of the services, compliance with legal obligations or the technological and administrative operation of Advisa International, personal data may be transmitted or transferred to third parties, within or outside Colombia, provided that the conditions and requirements established in applicable law are met.

In particular, this may include technology providers, storage platforms, communication tools, email services, management systems and other providers necessary for operations.

Where applicable, Advisa International shall adopt the contractual, technical and administrative measures necessary to protect the information.

13. Information security

Advisa International adopts reasonable and appropriate technical, human, administrative and organizational measures to protect personal data against loss, tampering, and unauthorized access, consultation, use or disclosure.

However, no information storage or transmission system can guarantee absolute security. Consequently, Advisa International shall maintain reasonable protection measures commensurate with the nature of the information and the risks identified.

14. Confidentiality

The persons involved in the Processing of personal data shall be obliged to maintain the confidentiality of the information to which they have access, even after the termination of their contractual or employment relationship, where applicable.

This obligation shall apply without prejudice to the legal duties to disclose information to competent authorities when there is a legal obligation to do so.

15. Cookies and similar technologies

The website of Advisa International may use cookies and similar technologies to facilitate its operation, improve the user experience, obtain browsing statistics, maintain security and, where applicable, carry out analysis or communication activities.

The specific use of these technologies shall be disclosed through the corresponding Cookie Policy or information mechanism enabled on the website.

16. Effective term and data retention

This Policy enters into force upon its publication.

Personal data shall be retained for the time necessary to fulfill the purposes for which it was collected, for as long as a contractual or commercial relationship exists, when there is a legal retention obligation, or for the periods necessary to address potential legal liabilities.

Once the corresponding purposes and obligations have been fulfilled, the data shall be deleted, anonymized or retained when there is a legal basis for doing so.

17. Updates to the policy

Advisa International may modify or update this Policy when necessary to reflect regulatory, operational or technological changes or changes in the purposes of the Processing.

When substantial changes occur, they shall be communicated to Data Subjects through appropriate means and in accordance with applicable law.

The version in force shall be permanently available on the website of Advisa International.

18. Contact information

For inquiries, claims, requests related to personal data or the exercise of the rights established in this Policy:

Advisa International

Email: gestion@advisainternational.com

WhatsApp: +57 324 402 17 92

City: Medellín, Antioquia, Colombia