Data Privacy Policy

Personal data policies and procedures manual of VIRTUALRIS S.A.S

This English version is provided for reference. In the event of any discrepancy, the Spanish version, governed by Colombian law, shall prevail.

1. Introduction

In compliance with current Colombian personal data protection legislation, in particular Law 1581 of 2012 and Decree 1377 of 2013, VIRTUALRIS S.A.S provides this policy, which describes the conditions under which it collects, stores, uses, shares and deletes the personal data of its clients, suppliers, employees, partners and other interested third parties, as well as the rights you have as the data subject.

This policy applies to the personal data recorded in the databases of VIRTUALRIS S.A.S that it processes, including data collected through this website.

2. Definitions

The following definitions allow a correct and appropriate interpretation of Law 1581 of 2012 and its regulatory decrees, and are essential for the protection of habeas data:

Privacy notice: verbal or written communication generated by the data controller and addressed to the data subject, informing them of the existence of the applicable information processing policies, how to access them and the purposes for which their personal data will be processed.
Authorization: prior, express and informed consent of the data subject to carry out the processing of their personal data.
Database: an organized set of personal data that is subject to processing.
Personal data: any information linked or that may be associated with one or more identified or identifiable natural persons.
Public data: data that is not semi-private, private or sensitive, such as data relating to a person's marital status, profession or trade and their status as a merchant or public servant. It may be contained, among others, in public registries, public documents, official gazettes and bulletins, and final court rulings that are not subject to confidentiality.
Private data: personal information whose knowledge is restricted and, in principle, private to the general public.
Semi-private data: data that is not intimate, confidential or public in nature and whose knowledge or disclosure may be of interest not only to its owner but to a certain sector or group of people or to society in general.
Sensitive data: data that affects the privacy of the data subject or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in trade unions or social organizations, health data, data on sexual life and biometric data.
Data processor: a natural or legal person, public or private, that alone or in association with others processes personal data on behalf of the data controller.
Data controller: a natural or legal person, public or private, that alone or in association with others decides on the database and/or the processing of the data.
Data subject: the natural person whose personal data is processed.
Transfer: the sending of personal data by the controller and/or processor located in Colombia to a recipient that is itself a data controller and is located inside or outside the country.
Transmission: the communication of personal data inside or outside Colombian territory for the purpose of processing by the processor on behalf of the controller.
Processing: any operation or set of operations on personal data, such as collection, storage, use, sharing or deletion.

3. Principles for the processing of personal data

VIRTUALRIS S.A.S observes the following principles when collecting, using and processing personal data:

Purpose: processing serves a legitimate purpose, which is communicated to the data subject.
Freedom: processing is carried out only with the prior, express and informed consent of the data subject. Data may not be obtained or disclosed without prior authorization, or in the absence of a legal or court order that waives consent.
Accuracy or quality: information subject to processing must be truthful, complete, accurate, up to date, verifiable and understandable.
Transparency: the data subject's right to obtain, at any time and without restriction, information about the existence of data concerning them is guaranteed.
Restricted access and sharing: personal data, except public information, will not be available on the Internet or other mass media unless access is technically controllable to provide restricted knowledge only to data subjects or authorized third parties.
Security: information is protected through the technical, human and administrative measures necessary to prevent its tampering, loss, consultation, use or unauthorized or fraudulent access.
Confidentiality: all personal data that is not public is confidential, even after the contractual relationship or the relationship with the data subject has ended.

4. Authorization

The processing of personal data requires the prior, express and informed authorization of the data subject, unless the law provides an exception to this rule. VIRTUALRIS S.A.S, as data controller, has put in place the mechanisms necessary to obtain such authorization, ensuring in all cases that it is possible to verify that it was granted.

Authorization may be recorded in a physical or electronic document or in any other format that allows later consultation, or through a suitable technical or technological mechanism that makes it possible to conclude unequivocally that, without the data subject's action, the data would never have been captured and stored.

5. Use and purpose of processing

Authorization for the processing of personal data allows VIRTUALRIS S.A.S to collect, transfer, store, use, share, delete, update and transmit the data for the following purposes:

Use the data of clients, suppliers, employees, managers, strategic partners and other interested third parties for the purpose for which it was obtained.
Fulfill the obligations agreed with clients, suppliers, employees, managers, strategic partners and other interested third parties.
Provide our services and products.
Respond to requests, inquiries and requirements received through our contact channels, including the form on this website.
Maintain efficient communication about our products, services, offers, alliances, studies, events and content.
Report changes and/or new products or services related to those contracted or acquired.
Validate information in compliance with legal know-your-client, supplier, employee or interested third-party requirements.
Verify economic activity, financial position, credit bureaus, commercial and bank references, and certificate of existence and legal representation.
Manage collection and receivables recovery actions.
Report fraud, corruption and/or illegal activities to the corresponding authorities.
Provide information required for commercial, statistical or technical support purposes or by legal mandate.
Carry out internal studies on consumption habits and the use of our services.

The scope of the authorization includes the power for VIRTUALRIS S.A.S to send messages with institutional content, advertising, notifications, account statement information and other information about its service portfolio by email, text message, postal mail or other means of communication.

6. Collection of personal data

Data collected with prior authorization will be limited to what is relevant and appropriate for the purpose for which it is collected, in accordance with current regulations.

Through this website we only collect the data you voluntarily provide in the contact form, such as your name, email address, phone number, company and the message you send us. This data is used exclusively to respond to your request and for the purposes described in this policy.

Personal data found in publicly accessible sources may be processed as long as, by their nature, they are public data.

7. Rights of the data subject

In accordance with Article 8 of Law 1581 of 2012, as the owner of the personal data you have the right to:

Access, update and correct your personal data held by VIRTUALRIS S.A.S, including partial, inaccurate, incomplete or fragmented data, data that is misleading, or data whose processing is prohibited or has not been authorized.
Request proof of the authorization granted, except where it is expressly exempted as a requirement for processing.
Be informed, upon request, of how your personal data has been used.
File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law.
Revoke the authorization and/or request deletion of the data when processing does not respect constitutional and legal principles, rights and guarantees.
Access, free of charge, your personal data that has been processed.

These rights may be exercised by the data subject, who must prove their identity; by their successors, who must prove that status; by their representative and/or attorney, upon proof of representation or power of attorney; and by stipulation in favor of or on behalf of another.

8. Procedure for exercising your rights

The data subject may exercise their rights of access, consultation, updating, correction, deletion and revocation of authorization through the VIRTUALRIS S.A.S contact channels available on this website, after proving their identity. Access to personal data is free of charge at least once a month, in accordance with Article 21 of Decree 1377 of 2013.

Inquiries: the data subject may consult the personal information held in our databases.
Claims: a data subject who believes their information should be corrected, updated or deleted, or who notices an alleged breach of any of the duties contained in the law or in this policy, may file a claim.
Updating and correction: the data subject may request that outdated data be updated and that incorrect data be corrected or deleted.
Deletion and revocation: the data subject or their successors may request deletion of their data and/or revoke the authorization granted, provided there is no legal or contractual duty to remain in the database.

The maximum period to address a claim is fifteen (15) business days from the day following the date of receipt. When it is not possible to address it within that period, the interested party will be informed of the reasons for the delay and the date on which it will be addressed, which may in no case exceed eight (8) business days after the first period expires.

VIRTUALRIS S.A.S is not responsible for incorrect data provided by the data subject.

9. Use of cookies

This website uses cookies, small text files stored in your browser when you visit our pages, which allow the site to work properly and help us understand how it is used. Cookies do not allow us to identify you personally or access information on your device.

Types of cookies we use

Technical or necessary cookies: enable browsing and the basic operation of the site, such as remembering the selected language and protecting the site against malicious access.
Analytics cookies: we use Google Analytics to obtain statistical information about site usage, such as pages visited, time spent or device type, in order to improve our content.
Third-party cookies: when you use the contact form, Google reCAPTCHA may set cookies to verify that the submission is made by a person and not an automated program. The floating contact button may take you to external services, which apply their own privacy policies.

This site has no comments, user registration or online store, so we do not use cookies associated with those features.

How to manage cookies

You can allow, block or delete cookies in your browser settings. Please note that disabling some cookies may affect how the site works. By continuing to browse, you accept the use of cookies under the terms described here.