Personal data processing policy
Last updated: October 25, 2026
Draft pending legal review. Details in square brackets will be completed before publication.
This is a translation. In case of discrepancy, the Spanish version prevails.
This policy explains what personal data we process when you visit this website, write to us or create and use an account in the Extandar Control Panel (www.extandar.com/c), what we use it for, what rights you have and how to exercise them. It follows Colombian Statutory Law 1581 of 2012, Decree 1377 of 2013 (incorporated into Single Decree 1074 of 2015) and the instructions of the Superintendence of Industry and Commerce (SIC). When the Extandar platform processes the data of your company’s workers (for example, in the occupational health and safety management system), it will do so under its own data processing policy.
1. Data controller
- Controller: [Razón social del titular]
- Tax ID (NIT): [NIT]
- Address: [Dirección de notificación, ciudad]
- Phone: [Teléfono de contacto]
- Email: contacto@extandar.example
2. What data we process and why
We only process the data needed for each purpose:
| When | Data | Purpose | Basis | Retention |
|---|---|---|---|---|
| You email us, including to request the free assessment | Email address, name and company if you provide them, and the content of the message | To reply and, if you ask, to let you know when you can take the assessment or use Extandar | Your authorization, which you give by writing to us after reading this policy and can revoke at any time | Until you revoke your authorization or, at most, 12 months after launch |
| You browse the site | IP address, browser, requested page, date and time (technical server logs) | To serve the site and keep it secure | Information security and the operation of the site you request | The hosting provider’s technical period, limited to what security requires |
| You browse the site (visit statistics) | Page visited and referring page, browser, operating system, device type, screen size, language and country. Your IP address is only used on the fly to infer the country and an anonymous identifier that changes every month; it is not stored | To know, in aggregate and anonymously, how many visits the site gets and how it is used, to improve it | Aggregate statistics that cannot identify you | 25 months |
| You create and use an account in the Control Panel | Name, email address, language and, if you create one, your password (which we only store irreversibly encrypted, without being able to know it); the version of the terms and of this policy you accepted and the date; and the sessions you open | To create and manage your account, let you sign in securely and send you account emails (email confirmation, password recovery and security notices) | Your authorization, which you give when creating the account by accepting this policy | While you have the account. You can delete it at any time from “My account” (if it doesn’t own any company) or ask us to, and its data is deleted. Unconfirmed sign-up requests expire after 24 hours and are deleted shortly afterwards |
| You sign in with your Google account | From your Google account we only receive your name, your email address, whether Google has verified it and an identifier of your Google account. We don’t receive your Google password or access your email, contacts, files or any other Google data | To create your account (after you confirm your name and accept this policy) or link your Google account to the account you already have with the same email, and let you sign in without a password | Your authorization, which you give by choosing “Continue with Google” and by accepting this policy when creating the account | While you have the account. If you don’t finish creating it, the data received expires after 30 minutes and is deleted shortly afterwards |
| You register a company in the Control Panel | Name or legal name, tax ID (NIT) if you provide it and its sites (name, address and municipality) | To provide the service for that company | Your authorization, as the owner of the account that registers the company | While the company remains registered in your account |
| You upload a company’s documents to the Control Panel (for now, its Chamber of Commerce certificate) | The document and what it contains: in the Chamber of Commerce certificate, the company’s details and those of its legal representative (name and ID number) and, sometimes, those of its partners or directors. Also the file name, its issue date, who uploaded it and when | To store the company’s documents so you can keep them organized, view them and download them, and to let you know when they need renewing | Your authorization, as the owner of the account that registers the company. If the document contains other people’s data, such as the legal representative’s, by uploading it you declare that you may share it with us for this purpose | While the company remains registered in your account or until you delete the document. When you delete it, the storage keeps a copy for 30 days to recover from mistakes and then it is erased |
We don’t process sensitive data, we don’t use your data for profiling or automated decision-making, and we don’t sell it. This site doesn’t use tracking cookies (see the cookie policy) and serves its fonts from its own server, without connecting to third parties. For visit statistics we use Umami, an open-source tool we host ourselves (analytics.extandar.com): it uses no cookies, doesn’t identify you, respects your browser’s “do not track” setting and its data is not shared with anyone.
3. Who else accesses the data
We don’t share your data with third parties unless required by law or by a competent authority. To provide the service we rely on providers acting as data processors, under a contract that requires them to process the data only on our instructions and with adequate security measures:
- Website and Control Panel hosting: [Proveedor de alojamiento]
- Email: [Proveedor de correo electrónico]
- Sending Control Panel account emails: Resend
- Database backups: Amazon Web Services (Amazon S3, in the United States)
- Storage of Control Panel documents: Amazon Web Services (Amazon S3, in the United States)
If you sign in with Google, Google LLC sends us the data listed above because you authorize it on its consent screen. Google is not our processor: it processes your Google account data under its own privacy policy. You can remove our access at any time from your Google account settings (myaccount.google.com, under connections to third-party apps). Your Extandar account isn’t deleted because of that: you can keep signing in with your password or create one with “Forgot your password?”.
4. International transfers and transmissions
If any of these providers processes data outside Colombia, it will do so in countries with an adequate level of data protection according to the SIC or with the safeguards required by article 26 of Law 1581 of 2012, through a data transmission agreement. Backups and Control Panel documents are stored in the United States, which is on the SIC’s list of countries with an adequate level of protection.
5. Your rights
As the data subject you can, at any time and free of charge:
- Know, update and correct your personal data.
- Request proof of the authorization you gave us.
- Be informed about how we have used your data.
- Revoke your authorization and request deletion of your data, unless there is a legal duty to keep it.
- File complaints with the SIC, after completing the inquiry or claim process with us.
6. How to exercise your rights
Write to contacto@extandar.example stating your name, the right you want to exercise and, for a claim, the facts behind it. This email is our channel for inquiries and claims.
- Inquiries (what data of yours we hold and how we use it): we reply within 10 business days. If we can’t meet that deadline, we explain why and reply within the following 5 business days.
- Claims (correcting, updating or deleting data, revoking authorization or reporting a breach): we reply within 15 business days. If we can’t meet that deadline, we explain why and reply within the following 8 business days.
If you believe we didn’t handle your request properly, you can contact the Superintendence of Industry and Commerce (www.sic.gov.co).
7. Children and adolescents
This site is aimed at businesses and is not intended for minors. We don’t knowingly collect data from children or adolescents; if we find we have received any, we will delete it.
8. Security
We apply appropriate technical, human and administrative measures to protect your data against loss and unauthorized access, use or consultation, such as encrypting the communications of the site and the Control Panel (HTTPS), storing passwords irreversibly encrypted, encrypting backups and stored documents, and making each company’s documents accessible only from the account that registered it.
9. Validity and changes to this policy
This policy applies from the update date shown above. The databases will remain in effect while the purposes described are maintained. If we make substantial changes to this policy, we’ll publish the new version on this page and, if we have your email, let you know before it applies.