Home / Legal Framework

Privacy Policy & Personal Data Processing Terms

In compliance with Statutory Law 1581 of 2012, Regulatory Decree 1377 of 2013, and related provisions of the Republic of Colombia.

Last updated: October 2026

Document Outline

Data Protection Officer

For inquiries regarding your personal data or to exercise your habeas data rights, contact our official channel:

info@reto.com.co

1. Identification of the Data Controller

La firma RETO Consultoría Estratégica (en adelante "RETO"), sociedad comercial legalmente constituida bajo las leyes de la República de Colombia, con domicilio principal en Bogotá D.C., correo electrónico de contacto oficial: info@reto.com.co, acts as Data Controller for personal data collected through its web portal and corporate channels.

2. Legal Framework & Scope of Application

La presente Política de Tratamiento de la Información se adopta en cumplimiento de lo dispuesto en la Ley Estatutaria 1581 de 2012, el Decreto Reglamentario 1377 de 2013, el Decreto Único Reglamentario 1074 de 2015 y demás disposiciones que las modifiquen, adicionen o complementen. Aplica a toda la información personal registrada en las bases de datos de RETO, obtenida en el desarrollo de sus actividades de consultoría estratégica, auditoría, gobierno TI, riesgos y asesoría corporativa.

3. Purposes of Personal Data Processing

Los datos personales recolectados por RETO a través de formularios digitales, comunicaciones electrónicas y relaciones comerciales son tratados para los siguientes fines:

Prompt management and response to inquiries, technical consulting requests, and corporate communications.
Structuring, presentation, and follow-up of technical and commercial proposals for strategic consulting services.
Execution and fulfillment of contractual engagements, Non-Disclosure Agreements (NDAs), and advisory agreements.
Distribution of relevant institutional updates, technical whitepapers on IT governance, AML/CFT compliance, and regulatory trends.
Compliance with statutory, tax, and reporting obligations before regulatory and supervisory authorities.

4. Data Subject Rights (ARCO Rights)

Pursuant to Article 8 of Statutory Law 1581 of 2012, data subjects are entitled to:

Know and Access Access your personal data that has undergone processing free of charge.

Update and Rectify Request the correction of inaccurate, incomplete, fragmented, or misleading personal data.

Delete and Revoke Request data deletion or revoke authorization when no statutory or contractual obligation prevents it.

File Claims Acudir ante la Superintendencia de Industria y Comercio (SIC) tras agotar el trámite directo con RETO.

5. Information Security Measures

RETO implementa estrictas medidas de seguridad técnicas, humanas y administrativas para salvaguardar la confidencialidad, integridad y disponibilidad de la información personal, impidiendo su adulteración, pérdida, consulta, uso o acceso no autorizado. Todas las comunicaciones a través de este portal emplean protocolos de cifrado SSL/TLS de alta robustez.

6. Procedure for Exercising Data Subject Rights (PQRS)

The data subject or their legal successors may submit inquiries or claims by sending an email to: info@reto.com.co specifying their full name, identification number, clear description of the request, and contact address.

Statutory Response Times:

• Inquiries: Maximum term of ten (10) business days from the date of receipt.

• Claims: Maximum term of fifteen (15) business days from the day following receipt.

7. Validity of the Policy and Databases

This policy takes effect upon institutional publication. Databases containing personal data shall remain valid for the period necessary to fulfill the purposes for which they were collected, or as required by statutory or contractual mandates.