Personal data processing policy
This English version is provided for convenience. In case of any discrepancy, the Spanish version prevails.
GRUPO EMPRESARIAL NEW WAY S.A.S. · Version 1 · Effective from October 20, 2026
1. Data controller
GRUPO EMPRESARIAL NEW WAY S.A.S., NIT (tax ID number) 901.855.061-7, domiciled in Bogotá D. C., Colombia, with address at Calle 66 # 59-31, email info@vergarameloabogado.site and telephone +57 305 749 6064.
2. Legal framework
Articles 15 and 20 of the Political Constitution of Colombia; Statutory Law 1581 of 2012 (Colombia's Data Protection Law); Decree 1377 of 2013 (now compiled in Single Regulatory Decree 1074 of 2015, the trade-sector compilation decree); and, with regard to the use of artificial intelligence tools, External Circular 002 of 2024 issued by the Superintendencia de Industria y Comercio (SIC, Colombia's data protection authority).
3. Definitions
This policy adopts the definitions set out in Article 3 of Law 1581 of 2012 and in Decree 1377 of 2013, in particular: authorization, data subject (titular), personal data, sensitive data, controller (responsable), processor (encargado), processing, transfer (sending data to a recipient who becomes a controller in its own right) and transmission (sharing data with a processor that handles it on the controller's behalf).
4. Principles
Processing is governed by the principles of legality, purpose, freedom (processing only with the data subject's consent), accuracy or quality, transparency, restricted access and circulation, security and confidentiality (Article 4 of Law 1581 of 2012).
5. Data we process and why
| Data subjects | Data | Purposes |
|---|---|---|
| Clients and their representatives | Name, job title, email, telephone number, and identification document for invoicing purposes | Entering into and performing contracts, invoicing, providing support and, where they so authorize, sending information about related services |
| Workshop participants | Name, email, job title, attendance, and their image and voice in the session recording | Organizing the session, issuing certificates of attendance and delivering the recording to the contracting client |
| Event registrants and people who book meetings | Name, email, job title, company and answers to forms | Organizing the event or meeting, sending reminders and the recording and, where they so authorize, sending offers of training and consulting services |
| Buyers of digital products | Name, email and billing details. Payment data is processed directly by the payment gateway | Delivering the product, invoicing and providing support |
Commercial communications addressed to the institutional email addresses of legal entities (for example, contact@company) do not, in themselves, involve the processing of personal data of individuals (natural persons). When an individual responds to such communications, their data is processed for the purposes set out in this policy, and they may exercise the rights described in section 8 at any time.
6. Sensitive data and data of minors
GRUPO EMPRESARIAL NEW WAY S.A.S. does not request sensitive data or data of children and adolescents. Participants are informed at the start of each session that it is being recorded, and the recording is used solely to deliver it to the contracting client.
7. Authorization
The data subject's authorization must be prior, express and informed. It is obtained through means that allow evidence of it to be kept: acceptance checkboxes on registration and booking forms, acceptance of service orders by email, or written communications. Authorization may be revoked at any time, unless there is a legal or contractual duty to retain the data.
8. Rights of data subjects
Under Article 8 of Law 1581 of 2012, data subjects may: (a) access, update and rectify their data; (b) request proof of the authorization granted; (c) be informed of how their data has been used; (d) file complaints with the SIC, once the inquiry or claim procedure before the controller has been exhausted; (e) revoke their authorization or request the deletion of their data where there is no legal or contractual duty to retain it; and (f) access their data free of charge.
9. Inquiries and claims
Channel: email to info@vergarameloabogado.site, with the subject line “Datos personales” (Personal data).
Inquiries: answered within a maximum of ten (10) business days from the date of receipt. If this is not possible, the data subject will be informed of the reason and of the new response date, which may not exceed five (5) additional business days (Article 14 of Law 1581 of 2012).
Claims (requests for correction, updating or deletion, or reports of non-compliance): must include the data subject's identification, a description of the facts, the address for the response and any documents the claimant wishes to rely on. If a claim is incomplete, the claimant will be asked, within the following five (5) days, to complete it; if two (2) months pass without the claimant doing so, the claim will be deemed withdrawn. Claims are resolved within a maximum of fifteen (15) business days, which may be extended by up to eight (8) additional business days, with notice of the reason for the delay (Article 15 of Law 1581 of 2012).
10. Responsible department
The office of the legal representative of GRUPO EMPRESARIAL NEW WAY S.A.S. handles inquiries and claims through the channel indicated in section 9.
11. Processors, artificial intelligence tools and international transmission
To operate, GRUPO EMPRESARIAL NEW WAY S.A.S. uses technology providers that may process data on its behalf as processors: Google (email, documents, spreadsheets and calendar), Vercel (website hosting and storage of the authorizations given through it), Resend (sending emails from the website), Anthropic (artificial intelligence tools for drafting communications and materials), Cal.com (scheduling), Make (task automation), Wompi (payment gateway) and its electronic invoicing provider. Some of these providers have servers outside Colombia; international transmission is carried out in accordance with Article 25 of Decree 1377 of 2013, under contracts or clauses that require the processor to handle the data in accordance with this policy.
Artificial intelligence tools are used only as an aid in drafting communications and materials. No automated decisions producing legal effects on data subjects are made, no sensitive data is entered into these tools, and the criteria of suitability, necessity, reasonableness and proportionality set out in the SIC's External Circular 002 of 2024 are applied.
12. Security
Reasonable technical and administrative measures are applied: business accounts with two-step verification, restricted access to information, and the exclusion of sensitive data from third-party tools.
13. Retention
Data is retained for as long as necessary to fulfill the purposes described and to comply with the statutory retention periods for accounting and commercial records. Once those periods have elapsed, the data is deleted.
14. Effective date and changes
This policy is effective from October 20, 2026. Material changes will be communicated through the website and, where appropriate, by email to data subjects.