Privacy Policy

The data controller is TecnoSoftt S.A.S., a commercial company registered in Barranquilla, Colombia. For all matters relating to personal data, reach us at privacidad@tecnosoftt.com.

We act as data controller for information submitted through the contact form on this site, for the data of people who apply to work with us, and for the data of our clients and suppliers within the scope of the services we provide.

In some circumstances we act as data processor on behalf of our clients, processing personal data on their instructions under a data processing agreement signed with them. In those cases the client is the data controller and we are the processor.

The details identifying the data controller are shown below and can be copied directly for use in formal communications or submissions to regulators.

Values shown with a dashed border are pending verification: replace them with the company's official details before publishing this policy.

This policy is governed by Law 1581 of 2012, the Colombian law on the protection of personal data, and its implementing Decree 1377 of 2013. The processing of sensitive data is additionally regulated by Law 1262 of 2008.

Where we process data of people in the European Economic Area, we also apply the General Data Protection Regulation (EU) 2016/679. Where a provision of Colombian law offers greater protection than the GDPR, the Colombian rule prevails.

Personal data: any information that identifies a natural person, or allows one to be identified, directly or indirectly. A name paired with an email address is personal data. Aggregate statistics that cannot be traced back to a person are not.

Sensitive data: information whose improper processing could affect the dignity or fundamental rights of a person. Colombian law includes health, biometric, genetic, sex-life and children data in this category. We do not request sensitive data through this website.

Processing: any operation performed on personal data, whether or not by automated means. Collection, storage, consultation, transmission and deletion are all processing.

Both Law 1581 and the GDPR set out the principles that govern any lawful processing, and we apply all of them. Processing is lawful, fair and transparent. Data is adequate, relevant and limited to what is necessary. It is accurate and kept up to date. It is kept no longer than necessary. It is processed securely. And the data subject is accountable for the processing.

In practice this means we will ask for your name and email if we need them to answer a question, but we will not ask for your date of birth, marital status or religion. We will not sell your data. We will not use it for a purpose you did not agree to.

We process personal data to: respond to inquiries and contact requests submitted through this site; prepare and send commercial proposals; manage the contractual relationship with clients and suppliers; manage the employment process, including applications and, where applicable, the employment relationship; comply with our tax, accounting and legal obligations; and maintain the security of our systems and prevent fraud.

We do not use the data you submit through the contact form for advertising. We do not add it to marketing databases without a separate and explicit consent.

We do not request sensitive data through this website, and we are not authorised to process it without your written, explicit and optional consent. The same applies to data from children under fourteen, which we neither request nor knowingly accept.

If you submit sensitive information to our general contact address by mistake, write to privacidad@tecnosoftt.com requesting its deletion. We will remove it without exception and without using it for any purpose.

Under Article 6 of the GDPR, processing must have a lawful basis. We rely on five: consent, where you have given it freely and can withdraw it at any time; performance of a contract, when processing is necessary to deliver a service you requested; legal obligation, when we must comply with tax or labour law; legitimate interests, when processing is necessary for our business and does not override your rights; and vital interests, in the rare cases where data is required to protect someone’s life.

The Colombian equivalent is the authorisation given by the data subject, which must be informed, unambiguous and freely given. For sensitive data, consent must be in writing.

The form on this site contains a mandatory field marking acceptance of this policy. By submitting it you declare that the information is true, that it is your own, or that you have the express authorisation of the person concerned.

If you provide data of third parties without their consent, you assume full liability for any claim they may bring against us. We may request proof of authorisation and, if we cannot verify it, we will delete the data and notify you.

Under Law 1581 you have the right of access, to know what personal data of yours we process and where we obtained it. The right of rectification, to correct inaccurate or incomplete data. The right of cancellation, to delete data processed without consent or whose purpose has been achieved. The right of objection, to oppose processing based on legitimate interest. The right to revoke consent at any time. And the right to know who received your data.

The GDPR adds the right to data portability, to receive your data in a structured, commonly used, machine-readable format; the right to erasure, known as the right to be forgotten; and the right to withdraw consent without justification. None of these rights are absolute: we may refuse a request when the law requires us to keep the data, or when responding would delete information about another person.

Requests must be sent to privacidad@tecnosoftt.com from the same email address used to register the data, or from a verified identity. We must confirm that whoever writes is the data subject, to prevent third parties from accessing someone else’s information.

We respond within fifteen business days for requests under Colombian law, and within one month for requests under the GDPR, extendable by two additional months when the request is complex. The response is free.

If your request is denied, we will explain the reason and tell you how to file a complaint before the Superintendencia de Industria y Comercio for Colombian residents, or before your local supervisory authority for residents of the European Economic Area.

We keep personal data for as long as necessary for the purpose it was collected, and then for the period the law requires us to retain it for prescription, tax and labour purposes.

Specifically: data from a commercial inquiry is kept for two years from the last communication, unless a contractual relationship is established; contract data is kept for five years from termination; tax and accounting data is kept for five years; and data from an unsuccessful application is kept for six months unless you object.

When the retention period ends, we delete the data or anonymise it so it can no longer be attributed to a person.

Some of our service providers are outside Colombia: cloud infrastructure, email delivery and error monitoring. When personal data leaves the country, the law requires the destination to guarantee a level of protection adequate to ours.

We rely on the standard contractual clauses approved by the European Commission, on adequacy decisions where they exist, and on the consent of the data subject where none of the above applies. You may request a copy of the safeguards we use, indicating the country of destination and the purpose of the transfer, by writing to privacidad@tecnosoftt.com.

We apply technical and organisational measures appropriate to the risk. Data in transit is encrypted with TLS 1.3 and data at rest with AES-256. Access follows the principle of least privilege, and every employee with access to production data must use two-factor authentication. Access to production systems is logged and reviewed. Backups are encrypted, and restoration is tested quarterly.

If a data breach is likely to result in a risk to your rights and freedoms, we will notify the Superintendencia de Industria y Comercio within three business days and, when the breach is likely to result in a high risk, we will notify you without undue delay, indicating the nature of the breach, the categories of data affected and the measures taken.

This site uses technical cookies that are strictly necessary for it to function, such as storing your theme preference, your language preference and your cookie consent choices. They are set without requiring consent and cannot be disabled without affecting the site.

Analytics and marketing cookies are only activated after you grant explicit consent through the cookie banner, and you can revoke that consent at any time. The complete list of cookies, their purpose and their duration is in the cookies policy.

The Superintendent of Industry and Commerce is the Data Supervisor designated by Law 1581. Any person may file a complaint before that entity when they consider that the processing of their personal data violates the law, and may also request the deletion of data obtained unlawfully before the law came into force.

The GDPR also recognises the right to lodge a complaint with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.

We review this policy at least once a year and whenever there is a change in our processing, in our legal obligations, or in the services we offer. Substantive changes are notified by email to the addresses we hold and are also highlighted on this page with the new date of last update.

Your continued use of the site after publication of a change constitutes acceptance of the updated policy.