Personal data processing policy

1. Data controller

ROMAP GROUP S.A.S., tax ID (NIT) 902.116.716-6, domiciled in Bogotá D.C., Colombia, address Calle 48 R Sur # 5M-33, phone 316 055 6401, email ventas@romapgroup.com.

Channel for personal data inquiries and claims: ventas@romapgroup.com, the "Exercise my rights" form on this site, or phone 316 055 6401.

2. What data we collect

We only ask for the data needed for each purpose:

• Quote requests: name, email, phone (optional), service of interest and the message you write.
• Portal account: name, ID type and number (to match your certificates), email, password (stored encrypted; we never see it), and optionally phone and company name.
• Certificates: client name or company, ID number, service type and date.
• Requests about your data: name, ID number, email and the details of your request.
• Proof of your authorizations: date and time, document accepted and its version, text shown, IP address and browser used. The law requires this to prove you authorized the processing.
• Technical security data: IP address and access logs needed to protect the site.
• Campaign parameters (UTM) from the link that brought you to the site, if any, to know which channel you came from. They do not identify you.

We do not collect sensitive data (for example health, biometric or ethnic origin data) or data from children or adolescents. Please do not include it in your messages.

3. Why we use your data

• To answer quote requests and contact you about them.
• To create and manage your account, verify you are a client and let you download your certificates.
• To issue, publish and allow verification of service certificates.
• To provide contracted services, invoice and meet legal, accounting and tax obligations.
• To handle requests, complaints, claims and personal data requests.
• To protect the security of the site and prevent fraud.

We do not use your data for advertising and we do not sell it. If in the future we want to send you marketing, we will ask for a separate authorization and respect the hours and channels set by Law 2300 of 2023.

4. Your rights

Under article 8 of Law 1581 of 2012, you can:

• Access, update and correct your data.
• Request proof of the authorization you gave us.
• Be informed about how we use your data.
• File complaints with the Superintendence of Industry and Commerce (SIC).
• Revoke your authorization or request deletion of your data, where there is no legal or contractual duty to keep it.
• Access your data free of charge.

5. How to exercise your rights

Send your request through the "Exercise my rights" form or to ventas@romapgroup.com, stating your name, ID number, the request and how to reply.

• Inquiries: answered within 10 business days of receipt. If that is not possible, we will tell you why and answer within 5 additional business days (art. 14, Law 1581).
• Claims (correction, update, deletion or non-compliance): answered within 15 business days. If that is not possible, we will tell you why and answer within 8 additional business days. If the claim is incomplete, we will ask you to complete it within 5 days; after 2 months without a reply it is considered withdrawn (art. 15, Law 1581).
• You must complete this process with us before going to the SIC (art. 16, Law 1581).

6. Authorization and proof

We ask for your authorization in advance, expressly and in an informed way, through an unticked checkbox that is separate from accepting the terms and conditions. We keep a record of every authorization and revocation that cannot be modified or deleted, so we can prove it to you or to the authority (Decree 1377 of 2013, arts. 7 and 8).

7. Processors and international transfers

To run the site we use technology providers that process data on our behalf and under our instructions:

• Supabase Inc. (United States): database, authentication and certificate storage.
• Vercel Inc. (United States): website hosting.
• An email provider to send confirmations and password resets.

This involves an international transmission of data to the United States. We require these providers to apply adequate security and confidentiality measures. We do not share your data with other third parties, except by order of a competent authority.

8. Security

We apply reasonable technical and administrative measures: encrypted connection (HTTPS), encrypted passwords, role-based access, private certificate storage with temporary download links and access logs. No system is completely infallible; if an incident affects your data, we will report it to the SIC and to you where applicable.

9. How long we keep your data

• Quote requests: up to 2 years from the last contact, unless it becomes a contract.
• Client, account and certificate data: for the duration of the business relationship and then for the period required by accounting and tax rules (generally 10 years, under art. 28 of Law 962 of 2005).
• Proof of authorizations: while the data is processed and for the limitation period of related legal actions.

10. Cookies

Our use of cookies is explained in the Cookie policy.

11. Validity and changes

This policy applies from the update date shown. Databases remain in force while the purposes described are being fulfilled. We will publish any substantial change and, if it affects the purposes, ask you for a new authorization.