Personal data processing policy
Last update date: September 10, 2025
1. Introduction
ELEcolombia S.A.S, identified with NIT 901723059-5, hereinafter referred to as “the Company”, recognizes the importance of privacy and the protection of personal data.
In compliance with the Colombian Constitution, Law 1581 of 2012, Decree 1377 of 2013, and aligned with international principles such as the EU General Data Protection Regulation (GDPR), this policy establishes the guidelines applicable to the processing of personal information of students, clients, providers, employees, and other data subjects.
2. Definitions
For the purposes of this policy, the following definitions apply:
-
Personal Data: Any information linked or that can be associated with one or more identified or identifiable natural persons.
-
Sensitive Data: Information that affects the privacy of the data subject or may generate discrimination (e.g., health, religious beliefs, sexual orientation, biometric data).
-
Processing: Any operation performed on personal data, such as collection, storage, use, circulation, or deletion.
-
Data Controller: The person or entity that makes decisions regarding the database and its processing.
-
Data Processor: The person or entity that processes personal data on behalf of the Controller.
-
International Data Transfer: The transfer of data to another country to be processed by a different Controller.
-
International Data Transmission: The transfer of data to another country to be processed by a Processor on behalf of the Controller.
3. Guiding Principles
The processing of personal data will be carried out under the following principles:
-
Legality: In accordance with applicable laws and regulations.
-
Purpose: Data is collected for legitimate, specific, and informed purposes.
-
Freedom: Processing is only carried out with prior, express, and informed consent.
-
Accuracy: Data must be truthful, complete, and up to date.
-
Transparency: Data subjects are guaranteed access to information about how their data is used.
-
Restricted Access and Circulation: Only authorized persons may access data.
-
Security: Data is protected against unauthorized access, loss, alteration, or misuse.
-
Confidentiality: All processing is handled under strict confidentiality obligations.
4. Purposes of Data Processing
The Company collects, stores, and uses personal data for the following purposes:
-
Academic and Contractual Purposes
-
Academic and administrative management of students.
-
Execution of educational service contracts.
-
Evaluation of academic performance.
-
-
Commercial and Marketing Purposes
-
Sending information about courses, promotions, events, and news.
-
Managing requests, inquiries, complaints, and claims.
-
Customer loyalty and follow-up.
-
-
Employment and Supplier Purposes
-
Management of recruitment, selection, contracting, and payments.
-
Compliance with labor, contractual, and tax obligations.
-
-
Legal and Regulatory Purposes
-
Compliance with obligations before competent authorities.
-
Preservation of information for the legally required time.
-
5. Personal Data Processed
The Company may process, among others, the following data:
-
Identification: full name, type and number of identification document.
-
Contact: address, phone number, email.
-
Academic and employment data: educational records, CVs, performance.
-
Sensitive data: only when strictly necessary and with express authorization.
-
Minors’ data: only when required for educational purposes and with authorization from parents or legal guardians.
6. Rights of Data Subjects
Data subjects may exercise the following rights:
-
Know, update, and correct their personal data.
-
Request proof of authorization granted.
-
Be informed about the use of their data.
-
Submit inquiries and claims.
-
Revoke authorization and/or request deletion when principles and guarantees are not respected.
-
Access their personal data free of charge.
7. Authorization for Data Processing
Processing of personal data requires prior, express, and informed authorization from the data subject, which may be obtained through:
-
Physical or electronic forms.
-
Digital acceptance when registering on the platform.
-
Written consent or recorded verbal consent.
8. Procedures for Inquiries and Claims
Data subjects may submit inquiries to know the information stored in our databases, or claims to request correction, updating, or deletion.
-
Inquiries: Maximum response time: 10 business days, extendable by 5 more.
-
Claims: Maximum response time: 15 business days, extendable by 8 more.
If the data subject considers that the Company is not complying, they may escalate the matter to the Superintendence of Industry and Commerce (SIC) in Colombia.
9. Data Transfer and Transmission
The Company may transfer or transmit data to third parties, within and outside Colombia, ensuring compliance with Colombian regulations and international standards. In such cases, confidentiality and data protection agreements will be signed.
10. Data Retention
Personal data will be retained for as long as necessary to fulfill the purposes for which it was collected and/or for the duration of the contractual relationship. Once the purpose has been met, the data will be deleted or anonymized, unless retention is required by law.
11. Data Security
The Company implements technical, human, and administrative measures to protect personal data against unauthorized access, loss, alteration, or destruction.
12. Policy Updates
Any changes to this policy will be published on the Company’s official website and communicated to data subjects in a timely manner.
13. Contact Information
Data subjects may exercise their rights through the following channels:
-
Email: info@oncalingo.com
-
Address: Calle 91 # 70 – 16 Medellín, Antioquia, Colombia
14. Acceptance
By accepting this policy, data subjects confirm that they have read and understood the terms herein and authorize ELEcolombia S.A.S to process their personal data in accordance with this policy.
Jennifer Katherine Gonzalez Vega
Legal representative and CEO
ELEcolombia S.A.S - Oncalingo
