Privacy and Personal Data Policy

The controller of your personal data is Corpshore Colombia, the Colombian subsidiary of Corpshore Solutions Corporation, headquartered in Toronto, Canada.

Corpshore Colombia operates from Bogotá, Medellín, Cali and Barranquilla. For any matter relating to personal data you may write to info@corpshore.solutions.

Corpshore Colombia decides on the database and the treatment of the personal data described in this Policy, and is answerable to the data subject and to the supervisory authority for that treatment.

This Policy applies to all personal data that Corpshore Colombia collects and treats through its website, its forms, its contact channels, its selection processes and its commercial operations, as well as to the data of clients, suppliers, candidates, employees and site visitors.

When Corpshore Colombia treats personal data on behalf of a client, within an outsourcing service, it acts as data processor and not as controller. In those cases the purposes and the means are defined by the client, and the treatment is governed by the services contract and by the relevant data processing agreements.

Data subject (titular): the natural person whose personal data is subject to treatment.

Personal data: any information linked to or that may be associated with one or more determined or determinable natural persons.

Sensitive data: data that affects the privacy of the subject or whose misuse may generate discrimination, such as racial or ethnic origin, political orientation, religious convictions, trade-union membership, health data, data on sex life and biometric data.

Treatment: any operation on personal data, such as collection, storage, use, circulation or deletion.

Data controller (responsable): the party who decides on the database and the treatment of the data.

Data processor (encargado): the party who carries out the treatment on behalf of the controller.

Authorisation: the prior, express and informed consent of the subject to carry out the treatment.

Privacy notice (aviso de privacidad): the communication made available to the subject to inform them about the treatment of their data.

We collect identification and contact data, such as name, email, phone and company, when you complete a form, book a call or write to us.

In selection processes we collect professional and academic data, such as the CV, experience, education, language level and references.

We collect technical browsing data, such as the IP address, device type and behaviour on the site, through cookies and similar technologies, in accordance with the Cookie Policy.

We do not ask for sensitive data through the website. If a specific process requires treating sensitive data, we will inform you and request your explicit authorisation, and you will not be obliged to provide it.

We treat your personal data to attend to your contact, quote and proposal requests, and to schedule and hold discovery calls.

To manage selection processes, assess applications, carry out the language assessment and communicate with candidates.

To provide and administer the contracted services, invoice and comply with contractual, accounting and tax obligations.

To send communications about our services and news when you have authorised it, with the possibility of withdrawing that authorisation at any time.

To comply with legal obligations, respond to requests from authorities and protect our rights.

To improve the website and the user experience, through analytics that respects your consent on cookies.

The treatment of your data is based on the prior, express and informed authorisation that you grant when you accept this Policy, tick the consent box on our forms or continue with a selection or contracting process.

The authorisation is kept with a record of the date, the means and the version of the consent text accepted, so that Corpshore Colombia can demonstrate that authorisation was granted when required.

In the cases provided for by law, the treatment may be carried out without authorisation, for example when required by a public entity in the exercise of its functions, in cases of medical or health emergency, or when the data is of a public nature.

Corpshore Colombia does not condition any activity on the subject providing sensitive data. When the treatment of sensitive data is necessary for a legitimate purpose, the explicit authorisation of the subject will be requested, they will be informed that they are not obliged to authorise it, and they will be told which sensitive data will be treated.

Sensitive data is treated with reinforced security measures and with access restricted to the personnel strictly necessary for the authorised purpose.

As a data subject you have the right to know, update and rectify your personal data before the controller or the processor.

To request proof of the authorisation granted, except where the law states that it is not necessary.

To be informed, upon request, about the use given to your personal data.

To file complaints with the Superintendencia de Industria y Comercio for breaches of the law.

To revoke the authorisation and to request the deletion of the data when there is no legal or contractual duty to retain it.

To access your personal data that has been treated, free of charge.

These rights may be exercised by the subject, by their successors, by their representative or attorney or by a party acting under a stipulation in favour of another.

To exercise your rights you may write to info@corpshore.solutions, stating your name, your request and the contact details for us to reply.

Enquiries will be handled within a maximum term of ten business days from receipt. When it is not possible to handle them within that term, you will be informed before it expires and the enquiry will be handled within the following five business days at the latest.

Claims will be processed within a maximum term of fifteen business days from the day following receipt. When it is not possible to resolve them within that term, you will be informed of the reasons and the date on which it will be handled, which will not exceed eight business days after the first term expires.

If the claim is incomplete, you will be asked to remedy the gaps within the following five days. After one month without a response, the request will be deemed withdrawn.

Corpshore Colombia may share personal data with processors that provide services on its behalf, such as providers of technology infrastructure, email, analytics and management of client and candidate relationships.

These processors treat the data only in accordance with the instructions of Corpshore Colombia and under contractual obligations of confidentiality and security.

We may also share data with the other entities of the Corpshore group for the purposes described in this Policy, and with authorities when there is a legal duty to do so.

Given the international nature of the Corpshore group, your data may be transferred or transmitted to other countries, including Canada, where the head office is located.

International transfers and transmissions are carried out in compliance with Ley 1581 de 2012 and Decreto 1377 de 2013, with the guarantees the rule requires, including the existence of the subject's authorisation or an adequate level of protection, or the signing of contractual clauses that ensure compliance with the principles and obligations of Colombian law.

Your personal data will be kept for the time necessary to fulfil the purposes of the treatment and to meet the applicable legal, accounting and contractual obligations.

When the data is no longer necessary for the authorised purposes and there is no legal duty to keep it, it will be deleted or securely anonymised.

The authorisation granted by the subject remains valid as long as it is not revoked and as long as the relationship that gave rise to the treatment subsists.

Corpshore Colombia adopts reasonable technical, human and administrative measures to protect personal data against loss, unauthorised access, alteration and improper disclosure.

These measures include access control based on the least-privilege principle, encryption in transit, traceability of access, staff training and incident management.

The treatment is also supported by the group's international security frameworks, whose scope at this entity is confirmed during due diligence.

The website uses cookies and similar technologies. The use of non-essential cookies requires your consent, which you may grant, refuse or change through the site's consent mechanism. The detail is set out in our Cookie Policy.

The site and services of Corpshore Colombia are not directed at minors. The treatment of data of children and adolescents will only be carried out when it responds to their best interest and with compliance with the legal requirements, including the authorisation of the legal representative where applicable.

The competent authority for the protection of personal data in Colombia is the Superintendencia de Industria y Comercio (SIC), through its Delegate Office for the Protection of Personal Data.

The subject may file complaints with the SIC when they consider that the data protection regulations have been breached, once the enquiry or claim procedure before Corpshore Colombia has been exhausted.

For services provided to international clients, Corpshore Colombia supports compliance with the data protection regimes applicable to the client, including the European Union General Data Protection Regulation (GDPR) where applicable.

In those cases Corpshore Colombia usually acts as data processor and provides the guarantees and commits the contractual clauses that the applicable regime requires, without this altering the law governing the treatment of the data that Corpshore Colombia treats as controller, which is Colombian law.

Corpshore Colombia applies the guiding principles of Ley 1581 de 2012 in all treatment of personal data.

Principle of legality: the treatment is a regulated activity subject to the law. Principle of purpose: the treatment responds to legitimate purposes informed to the subject. Principle of freedom: the treatment is only exercised with the prior, express and informed consent of the subject.

Principle of veracity or quality: the information subject to treatment is truthful, complete, accurate, up to date, verifiable and understandable. Principle of transparency: the subject is guaranteed the right to obtain information about their data. Principle of restricted access and circulation: the treatment is subject to the limits deriving from the nature of the data and from legal provisions.

Principle of security: the information is handled with the technical, human and administrative measures necessary to give security to the records. Principle of confidentiality: the persons involved in the treatment are obliged to guarantee the reserve of the information, even after their relationship with one of the tasks that the treatment comprises has ended.

As controller of the treatment, Corpshore Colombia complies with the duties set out in Ley 1581 de 2012, including: guaranteeing the subject the full and effective exercise of their rights, requesting and keeping the authorisation granted, informing the purpose of the collection, and processing enquiries and claims within the legal terms.

It also keeps the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorised access, updates the information when appropriate, rectifies the data when it is incorrect, and respects the security and privacy conditions of the subject's information.

When it acts as processor on behalf of a client, it also complies with the processor's duties, treating the data only in accordance with the controller's instructions and keeping the relevant confidentiality.

Site visitors: contact and browsing data, to attend to requests and improve the site.

Candidates: identification, contact, education, experience, language level and reference data, to manage selection processes and, if the person authorises it, for future opportunities through the talent community.

Employees and collaborators: data necessary for the employment or contractual relationship, social security, payroll, training and compliance with legal obligations.

Clients and suppliers: identification and contact data of the persons acting on their behalf, for commercial, contractual, accounting and tax management.

In all cases, the treatment is limited to the informed purposes and is subject to this Policy.

Corpshore Colombia has procedures for managing security incidents affecting personal data. When the law requires it, the Superintendencia de Industria y Comercio and the affected subjects will be informed, under the applicable terms.

Marketing communications are only sent to those who have authorised them. Each communication offers a simple means to withdraw the authorisation, and the newsletter subscription is managed separately from the other treatments.

We do not make decisions based solely on automated treatments that produce legal effects on the subject or significantly affect them, without a legal basis that permits it.

With respect to the personal data that Corpshore Colombia may have collected before the publication of this Policy, the company undertakes reasonable efforts to bring this Policy to the subject's attention and to obtain their authorisation when the law requires it.

If within the thirty business days following the communication the subject has not expressed their refusal and has continued in the relationship, it will be understood that the information may continue to be treated for the informed purposes, without prejudice to the subject's right to request the deletion of their data or the revocation of the authorisation at any time.

This Policy, together with the corresponding privacy notice, is kept permanently available on the website for consultation. The subject may request a copy by writing to info@corpshore.solutions.

Corpshore Colombia may modify this Policy to adapt it to regulatory changes or to its operation. Changes will be published on the website with their update date.

For questions, requests or to exercise your rights, write to info@corpshore.solutions. For general matters you may write to info@corpshore.solutions.