Book a callBook

Personal data processing policy

Last updated:

This English version is a courtesy translation. If there is any discrepancy, the Spanish version prevails.

1. Identification of the data controller

Cifradia is a technology trade name in the process of being incorporated as a commercial company in the Republic of Colombia. While that corporate and tax process is completed, the Data Controller is Juan Sebastián Abello, domiciled in Bogotá D.C., Colombia, with the address for notices at Calle 64C # 68B-97, Bogotá D.C., phone +57 319 582 1804 and the official contact email contacto@cifradia.com. Once the Tax Registry (NIT) is issued and the company is incorporated, this policy will be updated with the final company name and NIT.

2. Personal data processed

We only process personal data collected through the contact forms, meeting scheduling or direct support channels, and the data of Domain Feed API clients described in section 9:

  • Identification and contact data: full name, company or organization, email, phone (optional), service of interest, requested meeting mode (online or in person) and the message or description of the inquiry.
  • Technical and browsing data: IP address processed temporarily by Cloudflare to mitigate malicious traffic and for anti-bot verification. On our servers, except as stated for the API in section 9, the IP address is kept only in volatile memory for at most ten (10) minutes, with the sole purpose of limiting automated mass submissions, and is not stored in permanent databases.

Exclusion of sensitive data and minors’ data: under no circumstances does Cifradia request or process sensitive data (racial origin, religious beliefs, trade union membership, health or biometric data) or personal data of children and adolescents. Users are required to refrain from sending information of this kind.

3. Legitimate purposes of processing

The personal data collected will be used exclusively to:

  1. Attend to, process and answer the inquiries, information requests and messages received.
  2. Prepare, quote and send commercial and technical proposals for the services requested.
  3. Manage, perform, formalize and maintain the contractual and commercial relationship if services are contracted.
  4. Send informational or commercial communications only when the data subject has given prior, express and separate authorization for that purpose.
  5. Provide, protect and manage the Domain Feed API subscription, as described in section 9.

4. Prior, express and informed authorization

In compliance with Article 9 of Law 1581 of 2012, which reads:

Article 9. Authorization of the Data Subject. Without prejudice to the exceptions provided by law, Processing requires the prior and informed authorization of the Data Subject, which must be obtained by any means that can be consulted later.

All data processing requires the prior, explicit and informed authorization of the data subject. In its web forms, Cifradia obtains it through a mandatory, unticked checkbox (click-wrap model).

When data subjects write or call on their own initiative through the channels in section 1 (email or phone, including WhatsApp), without using a form, authorization is deemed given by unequivocal conduct (Article 7 of Decree 1377 of 2013, compiled in Article 2.2.2.25.2.4 of Decree 1074 of 2015) solely to answer their message and, if they ask for it, to prepare a proposal. For any other purpose in section 3, Cifradia will ask for express authorization before processing their data.

5. International transmission and transfer of personal data

To ensure the delivery, availability and security of its digital services, Cifradia contracts the technology infrastructure of specialized third-party providers, which involves the international transmission and transfer of personal data:

  • OVHcloud (Canada): web hosting and database storage.
  • Cloudflare Inc. (United States): content delivery network (CDN), cyberattack mitigation and anti-bot verification (Turnstile).
  • Hostinger International Ltd. (Cyprus): corporate email service provider.
  • Paddle.com Market Limited (United Kingdom): online reseller and Merchant of Record for Domain Feed API subscriptions: it processes the payment, issues the invoice and handles taxes. Paddle collects the payment and billing data directly from the buyer and processes it as an independent controller, under its own privacy policy.
  • Cal.com Inc. (United States): management and scheduling of online meetings.
  • WhatsApp / Meta Platforms Inc. (United States): optional direct instant messaging channel.

By accepting this policy, the data subject explicitly and unequivocally authorizes the international transfer and transmission of their data to these providers under adequate security standards.

6. Rights of data subjects

Under Article 8 of Law 1581 of 2012, data subjects have the following rights:

  1. To know, update and correct their personal data held by Cifradia.
  2. To request proof of the authorization given.
  3. To be informed of how their personal data has been used.
  4. To revoke the authorization and/or request the deletion of their data when there is no legal or contractual duty to keep it.
  5. To access their personal data being processed free of charge.
  6. To file complaints with the Superintendence of Industry and Commerce (SIC).

7. Procedure to exercise rights and prerequisite for complaints

Data subjects or their successors may file petitions, inquiries or claims by writing to contacto@cifradia.com.

Inquiries: answered within at most ten (10) business days from the date of receipt. If that is not possible, the requester will be informed of the reasons, and the answer will be given within an additional period of no more than five (5) business days.

Claims (update, deletion, correction or revocation): answered within at most fifteen (15) business days from the day after receipt. If the claim is incomplete, the requester will be asked within five (5) days to correct it. If two (2) months pass without the correction, the claim will be considered withdrawn. If the claim cannot be answered within the initial period, the requester will be notified before it expires and the answer will be given within the following eight (8) business days.

Procedural prerequisite (Art. 16, Law 1581 of 2012): the article reads:

Article 16. Procedural prerequisite. The Data Subject or successor may only file a complaint with the Superintendence of Industry and Commerce after exhausting the inquiry or claim procedure with the Data Controller or Data Processor.

Data subjects must first exhaust the inquiry or claim procedure directly with Cifradia before filing a complaint or claim with the Superintendence of Industry and Commerce (SIC).

8. Retention, backups and information security

  • Retention period: client data will be kept for the term of the contractual relationship and for the additional time required by tax and commercial rules. Contact requests that do not result in a commercial relationship will be deleted or anonymized within at most twenty-four (24) months.
  • Backups: daily system backups are made with a fourteen (14) day retention cycle on the server. After that period, deleted information disappears permanently from the backups. In addition, the hosting provider keeps one full copy of the server, which is replaced every twenty-four (24) hours.
  • Security measures: Cifradia applies encryption in transit (SSL/TLS), least-privilege access control and perimeter protection.

9. Data of Domain Feed API clients

When purchasing the Domain Feed API (see the API terms of use), the data subject gives the authorization of section 4 by accepting this policy on the checkout page. To provide the service, the following data is processed:

  • Payment and billing: payment and billing data (such as email, country and payment method) is collected and processed by Paddle, as Merchant of Record, under its own privacy policy. Cifradia does not receive payment method details and only keeps the identifiers that Paddle assigns to the client and the subscription.
  • Email: Cifradia retrieves the client’s email from Paddle only to send them the link to their key, through its own automation server (n8n) and its email provider (Hostinger). The n8n execution history keeps that email for at most fourteen (14) days.
  • Usage records: the number of requests per day for each key, to enforce the plan’s limits and handle support and claims. They are kept according to the client data retention period in section 8.
  • Access logs: requests to the API, with the source IP address, are logged for the security of the service and incident handling, and are deleted automatically after at most thirty (30) days; the daily copy of the server, which is replaced every twenty-four (24) hours, may keep them for up to one more day. The ingress proxy logs do not keep the IP address or the credentials.
  • Cloudflare: processes the IP addresses and requests sent to api.cifradia.com to deliver the service and mitigate malicious traffic.
  • Hosting: the service and its databases are hosted on OVHcloud (Canada). The server backups also contain this data, as described in section 8.

Only a fingerprint (hash) of the access key is stored, and the full key is never written to the logs.

Annex A. Exact authorization text for web forms

To ensure legal validity and compliance with Art. 9 of Law 1581 of 2012 and Art. 50 of Law 1480 of 2011, Cifradia’s web forms include the following unticked checkbox:

[ ] I give Cifradia my prior, explicit and informed authorization to collect, process and transfer internationally my personal data in order to answer my request and manage the commercial relationship, under the Personal Data Processing Policy and the Terms and Conditions.