Legal

Personal data protection policy

FORABI S.A.S. · Under Colombia's Law 1581 of 2012 and Decree 1074 of 2015 · Bogotá D.C., Colombia · Version 1.0

This is a courtesy translation. The Spanish version of this policy is the legally binding one; if the two differ, the Spanish text prevails.

Data controller

Legal name: FORABI S.A.S.
NIT (tax ID): 902.058.260-0
Registered address: Bogotá D.C., Colombia
Data requests email: billing@forabi.ai
Responsible area: Personal Data Protection Area of FORABI S.A.S.

1. Purpose, scope and applicable law

FORABI S.A.S. (hereinafter, "FORABI"), as controller of personal data, adopts this Policy in compliance with Article 15 of the Colombian Constitution, Colombia's Law 1581 of 2012, Decree 1074 of 2015 (which compiled Decree 1377 of 2013) and any other rules that amend, supplement or replace them.

This Policy sets out the guidelines, principles and procedures FORABI applies to the collection, storage, use, circulation and deletion of the personal data of the data subjects it deals with (including customers, business contacts, suppliers, contractors, job applicants, team members and users of its products and services), as well as the mechanisms through which data subjects can exercise their rights.

Scope regarding data processed on behalf of third parties. When FORABI processes personal data on behalf of a customer acting as controller (for example, in software development projects that involve patient data), FORABI acts as processor and its processing is governed by the corresponding data processing agreement and by the controller's instructions, without prejudice to compliance with this Policy where applicable.

2. Guiding principles

In all processing, FORABI applies the principles of Article 4 of Law 1581 of 2012: lawfulness, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality.

3. Purposes of processing

Managing the commercial and contractual relationship with customers, suppliers and partners.
Providing, invoicing and supporting consulting, software development and education services.
Handling requests, inquiries, quotes and contact requests.
Running recruitment processes and managing contractors and team members.
Meeting legal, tax, accounting and social security obligations.
Sending informational or commercial communications, when the data subject has authorized it.
Carrying out marketing activities, events, cohorts and training.
Ensuring information security and preventing fraud.

4. Sensitive data and data of minors

Processing sensitive data is prohibited except in the cases listed in Article 6 of Law 1581 of 2012. When FORABI processes sensitive data, it does so with the explicit authorization of the data subject (unless a legal exception applies), informing them that they are not required to authorize such processing and which data is sensitive. Data of children and adolescents is processed only when it serves their best interests, in accordance with Article 7 of Law 1581 of 2012.

5. Authorization of the data subject

FORABI obtains the data subject's authorization in advance, expressly and on an informed basis, through any means that allows later verification (paper, electronic, web forms, email or data messages under Law 527 of 1999). FORABI keeps proof of the authorization. No authorization is required in the cases listed in Article 10 of Law 1581 of 2012.

6. Rights of data subjects

Under Article 8 of Law 1581 of 2012, the data subject has the right to:

Know, update and correct their data held by FORABI.
Request proof of the authorization granted.
Be informed about how their data has been used.
File complaints with the Superintendencia de Industria y Comercio (SIC), Colombia's data protection authority, for violations of the law.
Revoke the authorization and/or request deletion of their data when the legal principles, rights and guarantees are not respected.
Access their personal data being processed, free of charge.

7. Procedure for inquiries and claims

The data subject or their successors may exercise their rights by email at billing@forabi.ai or through the other channels FORABI makes available.

Inquiries (Art. 14): answered within a maximum of ten (10) business days. Claims (Art. 15): answered within a maximum of fifteen (15) business days counted from the day after receipt, extendable as provided by law.

8. Security measures

FORABI adopts reasonable technical, human and administrative measures to protect personal data against tampering, loss, unauthorized or fraudulent access, use or consultation, including role-based access control, encryption where appropriate, per-customer isolation, audit logs, daily backups and confidentiality duties for its staff and sub-processors.

9. Data transfer and transmission

FORABI may transmit data to processors (including cloud infrastructure providers) to fulfill the authorized purposes, subject to protection duties equivalent to those in this Policy. International transfers and transmissions are subject to Articles 25 and 26 of Law 1581 of 2012.

10. Term

Personal data is kept for as long as necessary to fulfill the purposes of processing and the applicable legal obligations, after which it is deleted or anonymized. This Policy takes effect upon publication and supersedes all previous versions.