Privacy Policy and Data Protection

1. Identity of the Data Controller

In accordance with the General Data Protection Regulation (GDPR) of the European Union (Regulation EU 2016/679) and Colombian Law 1581 of 2012 on Personal Data Protection, the data controller responsible for processing your personal data is:

2. Personal Data We Collect

2.1. Data collected through the contact form

When you use our web contact form, we collect the following personal data:

• Full name
• Company name (optional)
• Email address
• Phone number / WhatsApp
• Business sector
• Type of project of interest
• City and country
• Message (optional)
• IP address (collected automatically)
• Form submission date and time

2.2. Data collected automatically (cookies and similar technologies)

Our website uses cookies and tracking technologies that may collect:

• Browser and device information
• Pages visited and time spent
• Referral source (how you arrived at our site)
• Interactions with site content

For more information about cookies, please see our Cookie Policy.

2.3. Data in internal management systems

If you are a supplier, client, or user of our internal systems (GestionProyectos, Gastos), we may process:

• Login credentials (username and encrypted password)
• Business contact information
• Tax data (NIT, tax information)
• Information about projects and business transactions

3. Purposes of Data Processing

We use your personal data for the following purposes:

4. Data Recipients

Your personal data may be shared with the following recipients:

4.1. Technology service providers

• Google LLC - Google Analytics (web analytics), Google reCAPTCHA (anti-spam protection). View privacy policy
• Gmail / Google Workspace - Email service for notifications

4.2. International transfers

4.3. We do not sell your data

3:75 Design and Architecture does NOT sell, rent, or trade your personal data to third parties for advertising purposes.

5. Data Retention Period

We retain your personal data for the following periods:

After these periods, your data will be securely deleted or irreversibly anonymized.

6. Your Rights as a Data Subject (GDPR)

Under the GDPR, you have the following rights:

6.1. Right of Access (Art. 15 GDPR)

You may request a copy of the personal data we hold about you.

6.2. Right to Rectification (Art. 16 GDPR)

You may request correction of inaccurate or incomplete data.

6.3. Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)

You may request deletion of your personal data when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw your consent and there is no other legal basis
• You object to the processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

6.4. Right to Restriction of Processing (Art. 18 GDPR)

You may request that we temporarily suspend processing of your data.

6.5. Right to Data Portability (Art. 20 GDPR)

You may request to receive your data in a structured, commonly used format (JSON, CSV, PDF).

6.6. Right to Object (Art. 21 GDPR)

You may object to processing of your data based on legitimate interest or for direct marketing purposes.

6.7. Right Not to be Subject to Automated Decision-Making (Art. 22 GDPR)

We currently do not use automated profiling or exclusively automated decision-making.

6.8. How to exercise your rights

To exercise any of these rights, you may:

Response time: We will respond to your request within a maximum of 30 calendar days (1 month) from receipt, as established in Art. 12.3 of the GDPR.

6.9. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with:

• In the European Union: Your national Data Protection Authority or any EU DPA
• In Colombia: Superintendencia de Industria y Comercio (SIC) - www.sic.gov.co

7. Security Measures

We implement appropriate technical and organizational measures to protect your personal data against:

• Unauthorized access
• Unauthorized alteration, disclosure, or destruction
• Accidental loss

Technical measures implemented:

• Password encryption using bcrypt algorithms
• Secure HTTPS connections with SSL/TLS certificates
• Anti-spam protection with Google reCAPTCHA v3
• CSRF token validation on forms
• Periodic database backups
• Access audit logging for internal systems
• Role and permission-based access restriction

8. Cookies and Tracking Technologies

This website uses cookies and similar technologies. For detailed information about what cookies we use, their purpose, duration, and how to manage them, please see our Cookie Policy.

When you access our website, a cookie consent banner will be displayed. You can accept, reject, or customize your preferences at any time.

9. Minors

Our services are directed at businesses and professionals. We do not intentionally collect data from minors under 18 years of age.

If a parent or legal guardian identifies that their minor child has provided personal data without consent, they should contact us immediately at [email protected] to arrange deletion.

10. Links to Third-Party Websites

Our website may contain links to third-party websites (social networks, suppliers, etc.). We are not responsible for the privacy practices of these external sites. We recommend reviewing their privacy policies before providing personal data.

11. Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy to adapt it to legislative, jurisprudential, or changes in our services or business practices.

Any modifications will be published on this page with an update to the "Last updated" date. Substantial changes will be notified to registered users by email.

We recommend periodically reviewing this policy to stay informed about how we protect your data.

12. Applicable Law and Jurisdiction

This Privacy Policy is governed by:

• Regulation (EU) 2016/679 (GDPR) - For users in the European Union
• Law 1581 of 2012 - Personal Data Protection in Colombia
• Decree 1377 of 2013 - Regulations for Law 1581 of 2012

For any dispute related to the processing of personal data, the parties submit to the jurisdiction of the courts of Colombia, without prejudice to the data subject's right to lodge a complaint with the supervisory authorities mentioned in section 6.9.