Personal data processing and privacy policy
1. Data controller
Fundación Bogota Institute — a non-profit entity domiciled in Bogotá D.C., Colombia.
Single channel for exercising data subject rights: director@bogotainstitute.com. Responsible unit: Office of the Director.
The tax identification number (NIT) will be added to this policy once the registration procedure has been completed.
This policy describes only the processing that currently exists. The site is informational: it has no forms, opens no enrolment and collects no payments. When the interest list, the learning platform and payment collection are enabled, this policy will be updated before the corresponding processing begins, and the date of the change will be stated.
2. What data is processed
The site has no forms, sets no cookies and stores nothing in the visitor's browser. The choice of language is carried in the page address (/ for Spanish, /en/ for English) and requires no data to be stored.
Personal data is processed in two situations only:
a) Voluntary correspondence
Anyone writing to the institutional address provides whatever data they choose to include: name, email address and the content of the message. Processing is limited to handling that communication.
b) Technical access logs
The hosting provider generates logs that may include IP address, browser type and the date and time of the request. These are necessary to deliver the service, to secure it and to prevent abuse. The Institute does not use them to identify individuals or to build profiles.
3. Purposes
- Responding to enquiries, requests and communications addressed to the Institute.
- Ensuring the security, integrity and operation of the site.
- Complying with applicable legal obligations.
Data is not used for third-party advertising, profiling or automated decision-making, and is neither transferred nor sold.
4. Consent and applicable regime
Unlike the European General Data Protection Regulation, which accepts contractual necessity as a free-standing legal basis, Colombian Law 1581 of 2012 retains prior, express and informed consent as the general rule, and the exceptions in article 10 do not include performance of a contract.
In the site's current state no consent is collected, because no data is gathered through forms. When the interest list or programme enrolment is enabled, consent will be collected expressly and separately for each purpose, with no pre-ticked boxes.
5. Data subject rights
Under article 8 of Law 1581 of 2012, the data subject has the right to:
- Know, update and rectify their personal data.
- Request proof of the consent given, except where the law waives that requirement.
- Be informed of the use made of their data.
- Lodge complaints with the Superintendence of Industry and Commerce for breaches of the law.
- Withdraw consent and request deletion where no legal or contractual duty to retain the data exists.
- Access their personal data free of charge.
6. How to exercise these rights
By writing to director@bogotainstitute.com, stating the data subject's name, a description of the facts, the specific request and contact details for the reply.
- Enquiries: answered within a maximum of ten (10) business days, extendable by five (5) more, under article 14 of Law 1581 of 2012.
- Complaints: answered within a maximum of fifteen (15) business days, extendable by eight (8) more, under article 15 of Law 1581 of 2012.
7. Processors and international transfers
To operate the site and the institutional email, the Institute relies on the following providers:
| Provider | Function | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc. | Site hosting, DNS and security | Technical access logs | Outside Colombia |
| Google LLC — Workspace | Institutional email | Voluntary correspondence | Outside Colombia |
The site's typefaces are served from its own domain: no transfer whatsoever is made to font providers.
These transfers are made under article 26 of Law 1581 of 2012. The Institute requires its providers to give contractual guarantees of security and confidentiality equivalent to those laid down in Colombian law.
8. Retention
| Category | Retention period |
|---|---|
| Voluntary correspondence | For as long as the purpose of the communication subsists |
| Technical access logs | In accordance with the hosting provider's retention policy |
Once the period has elapsed, data is deleted or anonymised, unless a legal duty of retention applies.
9. Minors
The site is not directed at minors and collects no data from minors. Should a future training programme admit participants under eighteen, the legal guardian's consent will be required and processing will be subject to article 7 of Law 1581 of 2012 and to the best interests of the child.
10. Security
The site is served exclusively over HTTPS, with forced redirection from HTTP and an HSTS policy. The Institute adopts reasonable technical, human and administrative measures to protect information against unauthorised access, loss, alteration or fraudulent use.
11. Term and amendments
This policy is in force from 2 November 2026. Material changes will be communicated by publishing the updated version at this same address, stating the date on which it takes effect.