PERSONAL DATA TREATMENT POLICY

1. Regulatory Framework and Applicable Principles

This policy is governed by current Colombian legislation on personal data protection, primarily:

• Law 1581 of 2012 (General Regime of Personal Data Protection).
• Decree 1377 of 2013 (Regulatory Decree of Law 1581).
• Law 1480 of 2011 (Consumer Statute, Art. 47).

Personal data processing by Extranjería y Migración is based on principles of Legality, Purpose, Freedom, Truthfulness/Quality, Transparency, Restricted Access/Circulation, Security, and Confidentiality.

2. Scope and Data Processing

This policy applies to all personal data provided by users (residents or non-residents in Colombia) to Extranjería y Migración, physically or digitally (website, forms, emails, WhatsApp, social media, phone calls, etc.).

The user, by accepting these Terms and Conditions and this Policy, grants prior, express, and informed authorization for the processing of their personal data.

3. Purpose of Data Collection

Personal data is collected for the following purposes inherent to Extranjería y Migración’s advisory and immigration services:

• a. Provide advisory and mediation services, sharing information with government entities (Ministry of Foreign Affairs, Migración Colombia, Notaries, etc.) and strategic partners.
• b. Fill out applications, forms, and registrations before competent authorities.
• c. Conduct case feasibility analysis and evaluation.
• d. Establish primary and alternative communications via email, calls, social media, and/or WhatsApp for notifications and follow-up.
• e. Handle and manage inquiries, complaints, claims, and suggestions (PQRS).
• f. Monitor and record calls and video calls between users and advisors for security and quality compliance.
• g. Manage administrative tasks, quotes, invoicing, receipts, and process tracking.
• h. Comply with legal requirements from government, judicial, or administrative entities.
• i. Process third-party data provided (emergency contacts, family members, spouses, children) to deliver services.
• j. Analyze website navigation, user experience, and personalize ads (using cookies and tracking technologies).
• k. Conduct satisfaction surveys, send informative updates on complementary immigration services, and conduct statistical studies.
• l. Inform through any channel about promotions, current or future products/services, events, and activities.
• m. Fulfill contractual and legal obligations with clients, employees, and suppliers.
• n. Perform marketing and consumer research to assess service quality.

4. Rights of Data Subjects

Data subjects (Users) have the right to:

• Access: Free access to personal data being processed.
• Update and Rectify: Request modification of incomplete, inaccurate, or outdated data.
• Revoke and Delete: Request data deletion or authorization revocation when no legal/contractual duty prevents it.
• Information: Be informed about how their data is used.
• Claims: File complaints with the Superintendency of Industry and Commerce (SIC) for violations of Law 1581 of 2012.

5. Sensitive Data Processing

Extranjería y Migración may process sensitive data related to Health or Biometrics only when strictly required for immigration procedures before competent entities. Data subjects are not obligated to provide sensitive information, and processing will adhere to high security and confidentiality measures.

6. Processing Data of Children and Adolescents (NNA)

In compliance with Article 7 of Law 1581 of 2012, data processing of minors follows strict rules:

• 1. Public Data: Only public data or data essential for immigration services requested by legal representatives (e.g., civil registry, passport number, dependent visa, photos) will be processed.
• 2. Heightened Authorization: Must be explicitly authorized by legal representatives (parents/guardians).
• 3. Specific Purpose: Must strictly serve the best interest and fundamental rights of the minor.
• 4. Marketing Prohibition: Use of minors' data for marketing/advertising is strictly prohibited.
• 5. Representation: Legal representatives may exercise access, update, rectification, and deletion rights on behalf of minors.

7. Procedure to Exercise Rights

Data subjects or legal representatives can submit requests in writing or via email to extranjeria123@gmail.com.

Requests must include full name, ID number, precise description of request, contact method, and supporting documents.

Inquiries: Responded within a maximum of 10 business days.

Claims: If incomplete, a response will be requested within 5 business days. Once complete, resolved within 15 business days.

8. Security Measures and Call Recording

Extranjería y Migración adopts technical, human, and administrative measures to prevent alteration, loss, unauthorized access, or fraud.

Users accept that calls and video communications may be recorded and monitored for security and quality purposes in accordance with current laws.

9. Policy Validity

This policy takes effect on October 20, 2025, and remains valid for the duration necessary to fulfill data processing purposes and legal obligations.