Personal Data Processing Policy
Last updated: July 2026 · Version 2026.08
OGI Global informs data subjects about personal data processing through https://ogi.crm, web forms, live chat and internal modules, in compliance with Colombian habeas data law.
1. Legal framework
This policy is based on:
- Colombian Constitution, Article 15 (habeas data)
- Statutory Law 1581 of 2012
- Decree 1074 of 2015
- Resolution 2893 of 2020 (MTIC — cookies and e-government sites)
- SIC External Circular 002 of 2015
2. Data controller
Controller: OGI Global. Country: Colombia. Tax ID: [Completar NIT ante registro mercantil].
Privacy contact: privacidad@ogi.crm.
Supervisory authority: Superintendencia de Industria y Comercio (SIC) (https://www.sic.gov.co).
3. Definitions
For this policy:
- Personal data: information associated with an identified or identifiable natural person.
- Data subject: the person whose data is processed.
- Controller: entity deciding on the database and/or processing — OGI Global.
- Processor: entity processing data on behalf of the controller.
- Processing: any operation on personal data.
- Authorization: prior, express and informed consent unless legally exempt.
4. Data we collect
Depending on the channel:
- Identity and contact: name, email, phone/WhatsApp, country of origin.
- Service information: service of interest, messages, experience, licenses.
- Digital context: visited URL, page, category, service, chat step.
- Consent evidence: date, policy version accepted, cookie preferences.
- Security logs: CRM access records (authorized staff only).
5. Purposes
We process data for legitimate, explicit and informed purposes:
- Handle advisory requests, applications and contacts you initiate.
- Commercial and operational case management with an OGI advisor.
- Fraud, impersonation and misuse prevention.
- Legal compliance and authority requests.
- Security, site experience and consent traceability.
6. Legal basis
Forms: unchecked acceptance box linked to this policy before submission.
Non-essential cookies: prior consent via banner with accept, reject and configure options.
We keep proof of authorization (date, policy version and channel) in our databases.
7. Principles
We apply Law 1581/2012 principles: legality, purpose, freedom, quality, transparency, restricted access, security, confidentiality and minimization.
8. Processors and transfers
We share data with processors under contractual safeguards:
- Supabase Inc. — PostgreSQL storage and CRM authentication.
- WhatsApp / Meta Platforms — when you choose that channel.
- Website hosting and CDN provider.
9. International transfers
When processing involves transfers outside Colombia, we apply contractual safeguards and reasonable technical measures under Law 1581/2012.
10. Retention
We retain data as needed to handle your request and reasonable follow-up (up to 24 months from last contact unless law requires otherwise) and to prove consent.
11. Your rights (habeas data)
You may exercise free of charge:
- Access, update and rectify your data.
- Request proof of authorization.
- Revoke authorization and request deletion when applicable.
- Free access at least once per month.
12. Queries and claims procedure
Send requests to privacidad@ogi.crm with full name, ID, description and contact details.
Queries: response within 10 business days (extendable 5 days with notice).
Claims: response within 15 business days (extendable 8 days with notice).
Unsatisfied responses may be filed with the SIC at www.sic.gov.co.
13. Security and fraud prevention
Technical: HTTPS/TLS, CRM access control, database RLS, strong staff passwords.
Organizational: limited access, consent logging, suspicious submission review.
OGI may reject data obtained through false information or impersonation.
14. National Database Registry (RNBD)
When required by applicable law, OGI Global will register with the SIC-administered RNBD and keep information updated.
15. Minors
Services target adults. We do not knowingly process minors' data without legal guardian authorization.
16. Validity and changes
This policy is effective upon publication. Material changes will be published with a new version; when consent is affected, we will request authorization again.