Privacy policy and personal data processing

Objective

To establish the criteria for the collection, storage, use, circulation and deletion of the personal data processed by WE ARE DATALAB S.A.S.

Scope

This policy applies to all personal information registered in the databases of WE ARE DATALAB S.A.S., which acts as the data controller.

Obligations

This policy is mandatory and strictly binding for WE ARE DATALAB S.A.S.

Data controller

WE ARE DATALAB S.A.S., a legally incorporated commercial company, identified with Colombian tax ID (NIT) 900.480.799-9, with its principal place of business in the city of Bogotá, Republic of Colombia.

• Website: https://wearedatalab.com/
• Phone: +57 301 266 0120 (Bogotá)
• Email for personal data matters: soporte-tecnico@wearedatalab.co

Processing and purpose

WE ARE DATALAB S.A.S. will collect, store, use and circulate personal information in order to:

• Send invitations to events and offer new products and services.
• Handle requests, complaints and claims.
• Conduct satisfaction surveys about the goods and services offered by WE ARE DATALAB S.A.S.
• Provide contact information to the sales force and/or distribution network, telemarketing, market research and any third party with which WE ARE DATALAB S.A.S. has a contractual relationship for activities of that kind (market research, telemarketing, etc.), so they can carry them out.
• Contact the data subject by phone to conduct surveys, studies and/or confirm personal data needed to perform a contractual relationship.
• Contact the data subject by electronic means (SMS or chat) to send news about loyalty campaigns or service improvements.

Processing of sensitive data

Any sensitive data collected will be processed for the following purposes:

• Send invitations to events and offer new products and services.
• Handle requests, complaints and claims.
• Conduct satisfaction surveys about the goods and services offered by WE ARE DATALAB S.A.S.
• Provide contact information to the sales force and/or distribution network, telemarketing, market research and any third party with which WE ARE DATALAB S.A.S. has a contractual relationship for activities of that kind (market research, telemarketing, etc.), so they can carry them out.
• Contact the data subject by phone to conduct surveys, studies and/or confirm personal data needed to perform a contractual relationship.
• Contact the data subject by electronic means (SMS or chat) to send news about loyalty campaigns or service improvements.

Rights of data subjects

As the owner of your personal data (data subject), you have the right to:

• (i) Access, free of charge, the data you provided that has been processed.
• (ii) Know, update and rectify your information when it is partial, inaccurate, incomplete, fragmented or misleading, or when its processing is prohibited or has not been authorized.
• (iii) Request proof of the authorization you granted.
• (iv) File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the applicable regulations.
• (v) Revoke your authorization and/or request the deletion of your data, provided there is no legal or contractual duty that prevents its deletion.
• (vi) Decline to answer questions about sensitive data. Answers about sensitive data or about data of children and adolescents are optional.

Petitions, inquiries and claims

The administrative area of WE ARE DATALAB S.A.S. is responsible for handling data subjects' requests to exercise their rights. You can reach it by email at soporte-tecnico@wearedatalab.co or by mobile phone at +57 301 266 0120.

Procedure to exercise the right of habeas data

In compliance with personal data protection regulations, WE ARE DATALAB S.A.S. sets out the procedure and minimum requirements to exercise your rights. To file and process your request, please provide the following information:

1. Full first and last name.
2. Contact details (physical and/or email address and contact phone numbers).
3. How you want to receive the response to your request.
4. The reason(s) or fact(s) behind the claim, with a brief description of the right you wish to exercise (know, update, rectify, request proof of the authorization granted, revoke it, delete or access the information).
5. Signature (if applicable) and identification number.

The maximum term provided by law to resolve your claim is fifteen (15) business days, counted from the day after it is received. If the claim cannot be resolved within that term, WE ARE DATALAB S.A.S. will inform the requester of the reasons for the delay and the date on which the claim will be resolved, which in no case may exceed eight (8) business days after the first term expires.

Once the terms set by Law 1581 of 2012 and the regulations that implement or complement it have been met, a data subject who is totally or partially denied the rights of access, update, rectification, deletion or revocation may bring the case to the Superintendence of Industry and Commerce (Deputy Superintendence for Personal Data Protection).

Web forms and CRM

When you fill out a form on this site (contact or quote request), the data you enter — name, work email, phone number with country code, company, service of interest and message — is sent over an encrypted connection (HTTPS) to a server operated by WE ARE DATALAB S.A.S. That server validates the request and records it in DataLab's CRM, the tool our sales team uses to manage and answer every request. Technical details of the request may be sent along with it, such as the page you wrote from and the source of the visit (for example, a campaign).

• How we use it: to answer your request, prepare a quote and handle sales follow-up, within the purposes of this policy.
• Your authorization: the form is only submitted if you accept this privacy policy.
• WhatsApp button: if you use the WhatsApp button, the details you enter before opening the chat are recorded in the CRM through the same encrypted channel, and then the conversation opens in WhatsApp. Anything you write inside WhatsApp is also subject to WhatsApp's terms and privacy policy.
• Security: your browser never connects directly to the CRM. CRM credentials, tokens and internal addresses exist only on the server; the site code that runs in your browser contains no access keys or tokens. To protect the forms against spam and abuse, the server applies automated checks (field validation, bot detection and a limit on submissions per connection) that may temporarily use technical data such as your IP address.

Cookies and analytics

This site uses Google Consent Mode v2 with prior consent. Until you accept, the analytics and advertising categories stay denied by default and no cookies of those types are set in your browser. If you choose "Necessary only", they stay off. While consent is denied, Google may receive basic signals without cookies or persistent identifiers (for example, that a page loaded), which it uses to estimate aggregate data.

• Necessary (always on): cookies and local storage that keep the site working and remember your choices, such as your cookie decision or the version of the site you chose to view (desktop or mobile, dl_view cookie). They are not used to profile you.
• Analytics (only if you accept): Google Analytics 4, loaded through Google Tag Manager, measures visits, page views, traffic sources and form submissions in aggregate to improve the site. It uses cookies such as _ga and _ga_*, which last up to two years. When enabled, Microsoft Clarity records how the site is used (clicks, scrolling and session replays) to improve usability.
• Advertising (only if you accept): when active, tags from platforms such as Google Ads, Meta or LinkedIn measure the results of our campaigns and allow us to show you DataLab ads.

The providers of these tools (Google, Microsoft, Meta and LinkedIn) process data under their own privacy policies and may do so outside Colombia.

You can change or withdraw your consent at any time through the "Cookie preferences" link in the footer of every page. You can also delete or block cookies in your browser settings; if you do, the site will ask for your preference again.

Effective date

This Personal Data Processing Policy has been in effect since December 1, 2021. This version was updated on September 26, 2026 to add the "Web forms and CRM" and "Cookies and analytics" sections for the new website.

The databases in which personal data is recorded will remain in effect for as long as the information is kept and used for the purposes described in this policy. Once those purposes are fulfilled, and provided there is no legal or contractual duty to keep your information, your data will be deleted from our databases. Personal data will be kept for as long as the contractual relationship with the data subject lasts. Personal data will be kept until the data subject requests its deletion, provided there is no legal duty to keep it.