Privacy and Personal Data Processing Policy

This policy explains how Vórtice Digital collects, uses, stores and protects the personal data of people who visit this website or contact us, in compliance with Colombian Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Sole Regulatory Decree 1074 of 2015) and the other Colombian personal data protection regulations.

1. Data controller

This same contact is the channel for inquiries, claims and requests about your personal data.

2. What data we collect and how

Contact form

Name, email, phone or WhatsApp (optional), the service you are interested in and the message you write. We also store the date and time you gave your authorization, as proof of it. Your request is recorded in our customer management system (CRM) and we also receive a copy by email.

Chat with Vorti (artificial intelligence assistant)

The text you write in the chat is sent, together with that session's conversation, to the Google Gemini API to generate the answers. Vorti will not ask you for personal data; we ask you not to write personal data, sensitive data or confidential information in the chat. If you would like us to contact you, please use the contact form.

We only keep a conversation with Vorti if, after chatting, you send us the contact form: in that case we attach it to your request in our CRM, to better understand what you need. If you do not send the form, we do not keep the conversation in our systems.

WhatsApp and email

If you write to us on WhatsApp or by email, we process the data you share with us (for example, your name, number, email address and the content of your messages) in order to reply.

Clients and administrative system (Odoo)

If you hire our services, we manage the business relationship in our administrative system (Odoo): your contact details, the data needed for invoicing (such as name or company name, ID document or tax ID and address), quotes, payments and project information.

That system is connected to Vórtice Digital's Gmail account to send and receive the company's emails from it (for example, quotes and invoices). This connection only accesses our own mailbox; never your Google account. The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Browsing the site

• Analytics: only if you accept it in the cookie notice, we use Google Analytics to obtain site usage statistics (pages visited, device type, approximate location). We have disabled advertising features and Google Signals. More details in the Cookie Policy.
• Server technical logs: like any web server, ours records technical data about requests (IP address, date and time, requested page, browser). We use it only for security, abuse prevention and error diagnosis.

3. Purposes of processing

• Answering your questions and information requests.
• Scheduling the free technical consultation you request.
• Preparing and sending you the technical proposals and quotes you ask for.
• If you become a client: performing the contract, invoicing, providing support and complying with legal, accounting and tax obligations.
• Keeping the site secure and preventing abuse (for example, mass sending of messages).
• If you accept it, measuring site usage to improve it.

We do not sell or rent your data, we do not use it for third-party advertising and we will not send you newsletters or advertising without a separate authorization.

4. Data we do not collect

We do not request sensitive data (such as racial or ethnic origin, political orientation, religious beliefs, health data, sex life or biometric data). Our services are not aimed at minors and we do not knowingly collect data from children or adolescents.

5. Authorization

We process your data with your prior, express and informed authorization. In the form, you give it by checking the authorization box; when you write to us on WhatsApp or by email, by sending us your data so that we can reply. You can revoke it at any time by writing to the email above, except when there is a legal or contractual duty to keep the data.

6. Providers that process data on our behalf and international transfers

To run the site we use technology providers that may process personal data on our behalf, in some cases outside Colombia. By authorizing the processing, you also authorize this international transfer. Each provider applies its own security measures and terms.

About the chat: depending on Google's terms and the service plan used, Google may use the content sent to the Gemini API to improve its products, and it may even be reviewed by human staff. That is why we insist that you do not share personal or confidential data in the chat.

7. Your rights as a data subject

Under Article 8 of Law 1581 of 2012, you have the right to:

• Access, update and correct your personal data.
• Request proof of the authorization you gave us.
• Be informed, upon request, about how we have used your data.
• File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law, once you have completed the inquiry or claim process with us.
• Revoke the authorization and/or request the deletion of your data when the legal principles, rights and guarantees are not respected, or when there is no legal or contractual duty to keep it.
• Access your personal data being processed free of charge.

8. How to exercise your rights

Write to us at vorticedigital02@gmail.com stating your name, how you would like to receive the answer, and your request (inquiry, update, correction, deletion or revocation). We may ask you for reasonable additional information to verify your identity.

• Inquiries: we answer them within a maximum of ten (10) business days from receipt. If that is not possible, we will tell you why and give you a new date, which will not exceed five (5) additional business days.
• Claims (correction, update, deletion or non-compliance): we handle them within a maximum of fifteen (15) business days from the day after receipt. If that is not possible, we will tell you why and give you a new date, which will not exceed eight (8) additional business days. If the claim is incomplete, we will ask you to complete it within the following five (5) days; if two (2) months pass without you completing it, it will be considered withdrawn.

9. Security

We apply reasonable technical and administrative measures to protect your data: encrypted connection (HTTPS) across the whole site, restricted access to the accounts and servers where data is received, and providers with their own security measures. No system is completely infallible; if an incident affects your data, we will report it to the Superintendence of Industry and Commerce and to those affected when the law requires it.

10. Data retention

• Contact requests that do not become a project: up to twenty-four (24) months from the last contact, unless you request deletion earlier.
• Client data: for the duration of the contractual relationship and the additional time required by accounting, tax and commercial regulations.
• Analytics data: the period configured in Google Analytics, never exceeding fourteen (14) months.
• Server technical logs: for a short period, for security purposes only.

The databases will remain in force for as long as Vórtice Digital carries out its activity.

11. Changes to this policy

If we make substantial changes to this policy, we will publish them on this page with the new effective date and, when the purposes of processing change, we will ask for a new authorization.