Legal

Personal Data Protection Policy

Last updated: 25 August 2026

This policy explains what personal data we collect, what we use it for, who we share it with, and how you can control it or have it deleted. It is issued under Colombia's Law 1581 of 2012, Decree 1377 of 2013 and related data protection rules.

It covers visitors to https://pasiolum.com, anyone who writes to us on WhatsApp or by email, and people whose data we process on behalf of businesses that hire us to run their conversational channels.

This is a courtesy translation. The Spanish version is the binding one before the Colombian authorities and prevails in case of discrepancy.

1. Who is accountable for your data

The Data Controller (Responsable del Tratamiento) is Santiago Posada García, a sole trader registered with the Cámara de Comercio de Medellín para Antioquia, trading under the name Pasiolum.

Controller: Santiago Posada García
Trading name: Pasiolum
Tax ID (NIT): 1026158599-4
Commercial registration: 21-855175-01
Address: Calle 40 # 38 B 18, Medellín, Antioquia, Colombia
Data protection contact: [email protected]
Phone and WhatsApp: +57 350 713 5902

2. Scope and definitions

Five terms from Colombian law are worth keeping in mind while reading this policy:

Personal data: any information linked to an identified or identifiable natural person.
Data subject (Titular): the person the data refers to. If you wrote to us, that is you.
Processing (Tratamiento): any operation on personal data — collecting, storing, using, circulating or deleting it.
Controller (Responsable): whoever decides on the database and the processing. On our own channels, that is us.
Processor (Encargado): whoever processes data on the controller's behalf. When we run a client business's WhatsApp, we are the processor and the business is the controller.

3. What data we collect

We only collect what we need to answer you and deliver the service. It depends on the channel:

Website: none. The site has no forms, sets no cookies, runs no analytics and creates no user accounts. Our server logs each visit's IP address and user agent for operations and security only.
WhatsApp: your phone number, your profile display name, the content of the messages you send (text, images, audio or documents) and the technical delivery and read metadata the platform generates.
Email: your address, your name and whatever you write to us.
Commercial relationship: if we end up working together, the billing and tax identification data required by law.

4. What we use it for

We process your personal data for these purposes:

Answering your enquiries and following up on them.
Preparing proposals, quotes and contracts.
Delivering, running and supporting the services you hire.
Issuing invoices and meeting accounting and tax obligations.
Sending you information about the service you contracted.
Complying with requests from authorities and other legal duties.

5. Authorisation and opt-in

We collect your data only with your prior, express and informed authorisation. When you start the conversation — writing to us on WhatsApp or by email — that unambiguous conduct constitutes authorisation to process the data needed to reply, under article 7 of Decree 1377 of 2013.

Receiving messages that are not a reply to your own requires a separate, explicit opt-in that tells you who will write to you and about what. This is required both by Colombian law and by the WhatsApp Business Messaging Policy.

You can withdraw your authorisation at any time by replying STOP on the same channel, or by writing to [email protected]. Withdrawal needs no justification and costs nothing.

6. WhatsApp Business Platform and Meta

Our WhatsApp channel runs on Meta Platforms, Inc.'s WhatsApp Business Platform (Cloud API). When you write to us there, your messages travel through Meta's infrastructure, which acts as a service provider and processes those messages on our instruction and on our behalf.

Meta does not use the content of the conversations you hold with us to personalise the ads you see. Meta's processing of your data as a WhatsApp user is additionally governed by the WhatsApp Privacy Policy at https://www.whatsapp.com/legal/privacy-policy.

We do not sell, rent or transfer your phone number or the content of your messages to third parties for advertising purposes.

7. Use of artificial intelligence

Messages we receive on WhatsApp may be processed by language models to understand your request and draft a reply. These are special-purpose assistants, limited to the business that operates them; they are not general-purpose chatbots.

We do not use the content of your conversations to train third-party models. You can ask for a human at any point by writing HUMAN, and the conversation is handed over to one.

Automatically generated replies can contain errors and do not constitute professional advice. Any commercial commitment is confirmed in writing by a person.

8. Processors and international transfers

To operate, we rely on technology providers that may access personal data under contract and on our instruction: Meta's messaging platform, cloud infrastructure providers, artificial intelligence model providers and email services.

Some of these providers are located outside Colombia, mainly in the United States and the European Union, so your data may be subject to international transmission or transfer. In those cases we contractually require security and confidentiality standards equivalent to those in this policy, under articles 24 and 26 of Law 1581 of 2012.

When we run conversational channels on behalf of a client business, we act as a processor: the business is the controller, defines the purposes and is accountable for its own customers' authorisation. In that scenario we process the data only to deliver the service to that business, and we return or delete it when the relationship ends.

9. Your rights

As the data subject, the law grants you the right to:

Access, update and rectify your personal data.
Request proof of the authorisation you granted, except where the law does not require it.
Be told how we have used your data.
Withdraw your authorisation and request deletion of your data, where no legal or contractual duty obliges us to keep it.
Access your personal data free of charge.
File a complaint with the Superintendencia de Industria y Comercio for breaches of Law 1581 of 2012, once you have exhausted the enquiry or claim process with us.

10. How to exercise your rights

Every enquiry and claim is handled at [email protected], a channel run directly by the controller. Tell us your name, a contact detail, what you are asking for and — if you have it — the conversation or phone number your request refers to.

The deadlines are the ones set by law:

Enquiries: 10 business days, extendable by 5 more business days with notice of the reason.
Claims: 15 business days, extendable by 8 more business days with notice of the reason.
Incomplete claim: We ask you for the missing details within 5 days. If you do not complete it within 2 months, the claim is treated as withdrawn.

11. How to delete your data

You can ask us to erase everything we hold about you. There are two ways to do it:

On WhatsApp: reply DELETE in the same chat, from the number whose data you want erased.
By email: write to [email protected] from your contact address, with the subject “Personal data deletion”, stating the phone number or email address involved.

What gets deleted: Your number, your profile name, the conversation history and any contact data derived from it.
How long it takes: We acknowledge receipt within 15 business days and carry out the deletion within that same period.
What may be kept: Only what the law requires us to keep — accounting and tax records for transactions already invoiced — blocked and not used commercially.

12. Security

We apply reasonable technical, human and administrative measures to protect your data against unauthorised access, loss, alteration or fraudulent use: encryption in transit, access control through individual credentials, least-privilege by default and periodic review of the providers involved.

No system is infallible. Should a security incident affect your data, we will inform you and report it to the Superintendencia de Industria y Comercio under article 17 of Law 1581 of 2012.

13. How long we keep it

We keep data for as long as the purpose that justified collecting it lasts. Conversations that do not lead to a commercial relationship are deleted twelve (12) months after the last interaction. Client data is kept for the duration of the contract and, afterwards, for the period required by accounting, tax and limitation rules.

14. Minors and sensitive data

Our services are aimed at adults and we do not knowingly collect data from children or adolescents. If we detect that we have received a minor's data without the authorisation of whoever holds parental responsibility, we delete it.

We also do not request sensitive data — health, ethnic origin, religious or political beliefs, biometric data, sexual orientation. You are not obliged to provide it and we ask you not to send it through these channels.

15. Cookies and analytics

As of the date of this policy, https://pasiolum.com sets no cookies, uses no tracking pixels and runs no analytics tools. If that changes, we will update this section and publish notice before switching them on.

16. Effective date

This policy is effective from 25 August 2026. The databases remain in force for as long as the purposes described here hold and the legal retention duties subsist.

Any substantial change will be published at this same address before taking effect. If the change affects the purposes of processing, we will ask for your authorisation again.