Last updated: August 16, 2026

This policy is governed by Colombian law (Law 1581 of 2012 and its implementing decrees). It is provided here in English for the convenience of our international visitors; the Spanish version is the authoritative text.

SPERTA CONSULTING SAS ensures the confidentiality and proper handling of the information it obtains, records, uses, transmits and updates through the prior, express and voluntary authorization of the data subject. This is carried out in strict compliance with Statutory Law 1581 of 2012 and its Regulatory Decree 1377 of 2013.

SPERTA CONSULTING SAS is committed to acting responsibly and protecting privacy by safeguarding the information held in its databases.

  • Political Constitution, Article 15
  • Law 1266 of 2008
  • Law 1581 of 2012
  • Regulatory Decrees 1727 of 2009 and 2952 of 2010
  • Partial Regulatory Decree 1377 of 2013

2. Scope

This policy applies to the personal information obtained by SPERTA CONSULTING SAS in the course of its employment-related and business activities.

3. Definitions

For the purposes of this policy:

3.1 Authorization

The data subject’s prior, express and informed consent to carry out the processing of personal data.

3.2 Privacy Notice

Verbal or written communication issued by the Data Controller to the data subject regarding the processing of their personal data, informing them of the existing data processing policies applicable to them, how to access them, and the purposes of the intended processing of their personal data.

3.3 Database

An organized set of personal data that is subject to processing.

3.4 Personal Data

Any information linked to, or that may be associated with, one or more identified or identifiable natural persons.

3.5 Public Data

Data that is not semi-private, private or sensitive. Public data includes, among others, data relating to a person’s marital status, profession or occupation, and their status as a merchant or public servant. By its nature, public data may be found, among other sources, in public records, public documents, official gazettes and bulletins, and duly enforced court rulings that are not subject to confidentiality.

3.6 Sensitive Data

Data that affects the data subject’s privacy or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social or human rights organizations, or data promoting the interests of any political party or guaranteeing the rights of opposition political parties, as well as data relating to health, sexual life, and biometric data.

3.7 Data Processor

A natural or legal person, public or private, who, alone or jointly with others, processes personal data on behalf of the Data Controller. Where the Data Controller does not act as the database processor, the processor will be expressly identified.

3.8 Habeas Data

The right of any person to know, update and correct information collected about them in databases and files of public and private entities.

3.9 Data Controller

A natural or legal person, public or private, who, alone or jointly with others, decides on the database and/or the processing of the data.

3.10 Data Subject

A natural person whose personal data is subject to processing. For the purposes of this Policy, data subjects are understood to include natural or legal persons who are suppliers, clients, benefactors and employees in general of SPERTA CONSULTING SAS.

3.11 Transfer

Data transfer occurs when the Data Controller and/or processor, located in Colombia, sends the information or personal data to a recipient who is also a Data Controller, located inside or outside the country.

3.12 Transmission

Processing of personal data that involves communicating it within or outside the territory of the Republic of Colombia when its purpose is for processing to be carried out by the processor on behalf of the Data Controller.

3.13 Processing

Any operation or set of operations performed on personal data, such as collection, storage, use, circulation or deletion.

4. Principles

In the development, interpretation and application of Law 1581 of 2012, which establishes general provisions for the protection of personal data, and the rules that supplement, modify or add to it, the following guiding principles shall be applied in a harmonious and comprehensive manner:

4.1 Purpose

Processing must serve a legitimate purpose in accordance with the Constitution and the law, which must be disclosed to the data subject. With respect to the collection of personal data, SPERTA CONSULTING SAS will limit itself to data that is relevant and appropriate for the purpose for which it was collected or required, in accordance with the internal procedures manual for handling information and databases.

4.2 Legality

The processing of data is a regulated activity that must comply with the provisions of the Law and other applicable regulations.

4.3 Freedom

Processing may only be carried out with the data subject’s prior, express and informed consent. Personal data may only be obtained or disclosed with prior authorization, or where a legal or judicial mandate relieves the need for consent.

4.4 Accuracy

Information subject to processing must be truthful, complete, accurate, up to date, verifiable and understandable. The processing of partial, incomplete, fragmented or misleading data is prohibited.

4.5 Transparency

Processing must guarantee the data subject’s right to obtain, from the Data Controller or processor, at any time and without restriction, information regarding the existence of data concerning them.

4.6 Access and Circulation

Processing is subject to the limits arising from the nature of personal data and the provisions of the Law and the Constitution. Accordingly, processing may only be carried out by persons authorized by the data subject and/or persons provided for by Law. Except for public information, personal data may not be made available on the Internet or other mass disclosure or communication media, unless access is technically controllable to provide restricted knowledge only to data subjects or authorized third parties in accordance with the Law.

4.7 Security

Information subject to processing by SPERTA CONSULTING SAS must be handled with the technical, human and administrative measures necessary to provide security for the records, preventing their adulteration, loss, unauthorized or fraudulent consultation, use or access.

4.8 Confidentiality

SPERTA CONSULTING SAS is obligated to guarantee the confidentiality of information, even after its relationship with any of the activities involved in the processing has ended, and may only supply or communicate personal data when this corresponds to activities authorized under the Law.

5. Use of Data

SPERTA CONSULTING SAS requires the data subject’s prior, informed and express authorization, obtained in writing, whether physically or electronically, so that it may be subject to later consultation.

When requesting information from the data subject, the Data Controller must clearly disclose the purpose for which the personal data is being collected, the processing to which the personal data may be subject, the data subject’s rights and the means through which they may exercise them, and, in the case of sensitive data, the option to authorize or not authorize the processing.

The purpose includes, without limitation:

  1. Complying with the legal and contractual obligations owed to clients, employees and distributors.
  2. Handling inquiries, requests, complaints and claims.
  3. Achieving effective communication regarding our products, services, offers, promotions, events, partnerships, studies, contests and content, as well as those of our affiliated companies, clients and strategic partners, and facilitating general access to their information.
  4. Evaluating the quality of our channels, processes, services and programs.
  5. Ensuring timely, quality supply from suppliers and compliance with their obligations.
  6. Determining outstanding obligations, consulting financial information and credit history, and reporting to credit bureaus.
  7. Responding to judicial or administrative requirements and complying with judicial or legal mandates.
  8. Contacting the data subject, via email or any other means, for the purposes described above.

The data subject’s authorization is not required in the following cases:

  1. Responding to a court order, or when requested by a public or administrative entity in the exercise of its legal functions.
  2. Personal data of a public nature.
  3. Medical or health emergencies.
  4. Information authorized by law for historical, statistical or scientific purposes.

6. Data of Children and Minors

SPERTA CONSULTING SAS does not process the personal data of minors (persons under 18 years of age in Colombia).

7. Rights of the Data Subject

The data subject has the right to know, correct and update their personal data; to request proof of authorization, except where the law provides for an exception; to be informed of how their personal data is being used; to submit inquiries and file complaints; to request that SPERTA CONSULTING SAS revoke authorization in the event of non-compliance with applicable regulations; and to access, free of charge, the personal data that has been processed.

8. Duties of the Data Subject

The data subject must guarantee the accuracy of the information provided to SPERTA CONSULTING SAS and update it in a timely manner. In the event of false information being provided, SPERTA CONSULTING SAS is released from any liability.

9. Data Controller Responsible for Processing Personal Data