Privacy Policy

Home Privacy Policy

Personal Data Protection Policy of AFS Consulting S.A.S.
Last updated: June 2, 2025

1. Introduction

AFS Consulting S.A.S. (hereinafter, “AFS” or “the Firm”), with registered office at Carrera 103B No. 154 – 61, Bogotá, Colombia, is committed to protecting and responsibly handling the personal data of our clients, suppliers, employees, and any user of our website (hereinafter, “the Site”). This “Personal Data Protection Policy” (hereinafter, “the Policy”) describes how we collect, use, store, transfer, and safeguard any personal information you provide when visiting or interacting with the Site.

AFS fully complies with the current Colombian data protection framework, in particular:

Law 1581 of 2012 (Personal Data Protection Law, “Habeas Data”).
Decree 1377 of 2013, regulating Law 1581 of 2012.
Other complementary regulations and circulars issued by the Superintendency of Industry and Commerce (SIC) related to data protection.

Please read this Policy carefully. By browsing the Site, registering, or providing personal data, you agree to the practices described herein. If you do not agree with any part of this Policy, please refrain from continuing to provide information or using the Site.

2. Data Controller and Contact Information

Data Controller:
AFS Consulting S.A.S.
NIT: 901.234.567-8
Address: Carrera 103B No. 154 – 61, Bogotá, Colombia
Contact email: [email protected]

To exercise your rights or submit inquiries regarding your personal data (access, rectification, deletion, objection, restriction of processing, or revocation of consent), you may contact us at the email address above. We will respond within a maximum of fifteen (15) business days from the date we receive your request.

3. Personal Data We Collect

3.1. Data You Provide Directly

Identification Data: full name, type and number of identity document (Colombian citizenship ID, foreigner ID, passport, or other).
Contact Data: email address, landline and/or mobile phone number, physical address (home or workplace).
Employment and Professional Data: occupation or position, company name or business name, tax identification number (NIT or professional license number), fiscal address.
Financial and Tax Data: banking details (account number, financial institution, account type) when required for invoicing, payments, or withholding.
Authentication Data: passwords (if the Site contains restricted-access areas), security questions, and other access credentials.
Other Voluntary Data: any additional information you provide when completing forms, subscribing to newsletters, participating in surveys or promotions, or when contacting us via chat, contact form, or email.

3.2. Data Collected Automatically

Technical Information: IP address, date and time of access, browser and version, operating system, device type (desktop, tablet, or mobile), pages visited on the Site, time spent on the Site, referring URL.
Cookies and Similar Technologies: We use both first-party and third-party cookies for the following purposes:
1. Authentication and Security: strictly necessary cookies for Site functionality.
2. Preferences and Functionality: to remember language settings, display preferences, and other customized features.
3. Analytical/Performance: through tools such as Google Analytics, to measure traffic, user behavior, and optimize Site content.
4. Marketing and Advertising: to display personalized ads or track advertising campaigns.

You can configure your browser to reject or delete cookies at any time (see section 9 “Cookies” below). However, disabling or deleting cookies may partially affect the Site’s functionality.

4. Purposes of Processing

The personal data we collect will be used for the following purposes:

Provision of Accounting, Audit, and Tax Advisory Services:
- Identifying and verifying the identity of clients and suppliers.
- Preparing accounting reports, financial statements, and tax returns.
- Providing tax planning and regulatory compliance advice.
Contractual and Administrative Management:
- Drafting, managing, and executing service contracts.
- Invoicing, reconciliation, and collection of fees.
- Handling requests, inquiries, and technical support through our available channels.
Marketing and Commercial Communications:
- Sending informational newsletters, alerts about tax and regulatory changes, and relevant accounting news.
- Promoting new services and events organized by AFS.
- Conducting satisfaction surveys, market analysis, and trend studies.
Site Improvement and Security:
- Monitoring Site operation, identifying errors, and preventing fraud or cyberattacks.
- Analyzing usage statistics to optimize user experience.
Legal Compliance:
- Reporting and withholding information for Colombian tax authorities (e.g., DIAN) and other oversight bodies when required.
- Retaining accounting and tax records for the minimum statutory period (five years in general).

5. Legal Basis for Data Processing

Under Law 1581 of 2012 and Decree 1377 of 2013, the legal basis for processing personal data in each case is:

Express Consent: for sending commercial communications, newsletters, and promotions. You may revoke your consent at any time by emailing [email protected].
Performance of a Contract: when processing is necessary to fulfill the contractual relationship between AFS and its clients or suppliers (e.g., preparing financial statements, invoicing, or tax advisory).
Legal Obligation: when processing is required to comply with tax, accounting, or anti–money laundering regulations.
Legitimate Interests of AFS: to ensure Site security, prevent fraud, and perform statistical analysis, provided that these interests are balanced against data subjects’ rights.

6. Data Transfers and Sharing

6.1. Internal Transfers

Personal data you provide will only be shared internally with authorized AFS personnel (accountants, auditors, consultants, and administrative staff) to the extent necessary for them to perform their duties. All employees are contractually obligated to maintain data confidentiality.

6.2. Transfers to Data Processors

To enhance our service quality and Site operations, we may transfer personal data to third-party service providers (“Data Processors”), including:

Hosting and cloud storage providers.
Statistical analysis platforms (e.g., Google Analytics).
Email delivery services (e.g., Mailchimp, Brevo, or MDirector).
Accounting and payroll software providers when technical integration is required.
Cybersecurity service providers (firewall, antivirus, intrusion prevention systems).

All such Data Processors are bound by contractual agreements ensuring they maintain confidentiality, use data only for the agreed purposes, and refrain from further transfers without AFS’s prior written authorization.

6.3. International Transfers

In exceptional cases where a provided service requires processing data outside Colombia (e.g., servers located abroad), AFS will ensure adequate transfer mechanisms in accordance with Law 1581 of 2012 and Decree 1377 of 2013. These mechanisms include contractual clauses guaranteeing equivalent levels of data protection.

Under no circumstances will AFS sell, lease, or commercially transfer personal data to third parties beyond the purposes described.

7. Data Subject Rights

As a data subject, you have the following rights, which you may exercise by submitting a request to AFS at [email protected]:

Right of Access: to know which personal data we hold about you.
Right of Rectification: to request correction or update of inaccurate, incomplete, or outdated data.
Right of Deletion (Right to Be Forgotten): to request erasure of personal data when it is no longer necessary for its collected purpose, or if you have withdrawn consent (subject to legal exceptions requiring retention).
Right to Object: to object to data processing for legitimate reasons or when data is used for direct marketing.
Right to Restrict Processing: to request that AFS restrict processing under certain circumstances (e.g., while verifying the accuracy of data).
Right to Data Portability: to receive personal data in a structured, commonly used format and transmit it to another controller, when technically feasible (primarily within the GDPR’s scope).

7.1. Procedure for Exercising Rights

To exercise any of these rights, you must:

Send an email to [email protected] with the subject line “Personal Data Protection Request.”
Provide in your message:
- Full name and type and number of identity document.
- Clear description of the request and the specific right you wish to exercise.
- Contact information (email or phone) where we can send our response.
- Any document proving your identity or legitimacy (e.g., copy of your ID).

AFS will send an acknowledgment of receipt within ten (10) business days and will resolve your request within a maximum of fifteen (15) business days. If your request is denied, we will explain the reasons for denial.

8. Information Security

We implement reasonable technical, organizational, and administrative measures to protect your personal data against loss, destruction, unauthorized access, or breach. Among these measures are:

Data Encryption: using HTTPS/SSL encryption for all communications between your browser and our servers, ensuring confidentiality during transmission.
Access Controls: employing strong authentication methods (secure passwords, two-factor authentication for critical systems) and granting minimum necessary access privileges to personnel.
Secure Storage: data is stored on servers located in data centers with recognized security certifications (e.g., ISO 27001, SOC 2) and backed up regularly.
Continuous Updates: applying patches and software updates to servers, databases, and applications to mitigate vulnerabilities.
Audits and Penetration Testing: conducting periodic internal and external audits and penetration tests to identify and address security risks.

Despite these measures, no system is completely infallible. In the event of a security breach affecting the confidentiality or integrity of personal data, we will notify the Superintendency of Industry and Commerce (SIC) and affected individuals within the timelines established by law (generally, within ten business days of discovering the breach).

9. Cookies and Tracking Technologies

9.1. What Are Cookies?

Cookies are small text files stored on your device when you visit the Site. They facilitate and optimize navigation and help compile usage statistics.

9.2. Types of Cookies We Use

Essential Cookies: strictly necessary for the Site’s basic functionality (e.g., authentication, session maintenance).
Preferences/Functionality Cookies: remember user choices (language, time zone, display preferences) to enhance experience.
Analytical/Performance Cookies: gather anonymous data about Site usage (e.g., pages visited, time spent) via tools like Google Analytics.
Marketing/Advertising Cookies: track browsing habits to display ads relevant to your interests; these may be first-party or third-party cookies (e.g., social media plugins, ad networks).

9.3. How to Disable or Delete Cookies

You may accept, reject, or delete cookies at any time via your browser settings:

Google Chrome: Settings → Privacy and security → Cookies and other site data.
Mozilla Firefox: Options → Privacy & Security → Cookies and Site Data.
Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data.
Safari (macOS): Preferences → Privacy → Manage Website Data.

Disabling or deleting cookies may limit certain Site features or prevent some functions from operating correctly.

10. Minors

The Site and AFS’s services are intended exclusively for individuals of legal age (18 years or older). We do not knowingly collect personal data from minors. If you believe a minor has provided information through the Site, please notify us immediately at [email protected] so that we can delete such information promptly.

11. Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required by law. Specifically:

Tax and Accounting Records: retained for a minimum of five (5) years, in accordance with Article 19 of Law 1607 of 2012 and DIAN regulations.
Subscription and Marketing Data: retained until you withdraw consent for receiving communications.
Browsing and Analytics Data: retained for up to two (2) years for statistical and Site improvement purposes.

After these retention periods expire, data will be securely deleted or anonymized so that it can no longer be linked to an individual.

12. Changes to This Policy

AFS reserves the right to modify this Policy at any time to adapt to changes in Colombian law, business practices, or technological updates.

Notification of Changes: any substantial modifications will be announced by a prominent notice on the Site and, where applicable, via email to users subscribed to our newsletter.
Effective Date: each update will carry a new “Last updated” date at the top. We recommend reviewing this Policy periodically to stay informed of any changes.

13. Links to Third-Party Sites

The Site may contain links to third-party websites (e.g., social media, payment platforms, trade associations). AFS is not responsible for the privacy practices or content of these external sites. We advise you to review the privacy policies of any third-party sites before submitting personal information.

14. Disclosure to Authorities and Legal Compliance

AFS may access, process, or disclose personal data when:

Required by a judicial or administrative authority (e.g., DIAN inquiries, regulatory inspections).
Necessary to defend rights in legal or administrative proceedings.
Indispensable to comply with anti–money laundering and anti–terrorism financing obligations, in accordance with Law 1121 of 2006 and Superintendence of Companies circulars.

In such cases, we will supply only the information expressly requested and strictly in accordance with a formal legal or administrative requirement.

15. Accuracy and Updates of Data

You agree to provide truthful, accurate, complete, and current information. If any of your personal data changes, you must inform us as soon as possible by emailing [email protected] to ensure data quality and the proper delivery of our services.

16. Liability

AFS shall not be liable for:

The accuracy or truthfulness of data you voluntarily supply.
Misuse or loss of your access credentials (e.g., username and password) if you share them with third parties or fail to follow recommended security practices.
Breaches outside our control, such as data breaches on social networks or platforms external to our Site.

17. Contact and Complaint Channels

For questions, complaints, claims, or to exercise your ARCO rights (Access, Rectification, Cancellation, and Opposition), as well as any inquiries regarding this Policy, please contact:

Email: [email protected]
Address: Carrera 103B No. 154 – 61, Bogotá, Colombia

We commit to addressing your requests within the timeframes and conditions established by Colombian regulations. To file complaints with the Superintendency of Industry and Commerce (SIC), please visit their official website and follow the prescribed procedure.

18. Acceptance and Validity

By accepting this Policy and using the Site, you acknowledge that you have read, understood, and fully agreed to its terms. This Policy is effective as of the “Last updated” date indicated above and governs all processing of personal data performed by AFS Consulting S.A.S. through the Site.

AFS Consulting S.A.S.
Carrera 103B No. 154 – 61, Bogotá, Colombia
[email protected]