Privacy Policy

Data Controller

[EDIT: full company name] (hereinafter, "Arcon Labs"), with its principal domicile at [EDIT: address, city], Colombia, acts as Controller of the Processing of the personal data collected through the arconlabs.io site and the contact channels described in this policy.

Contact of the controller for data protection matters:

• Email: starboy@arconlabs.io
• Postal address: [EDIT: postal address]

Scope and definitions

This policy applies to all personal data that Arcon Labs collects, stores, uses, circulates or deletes in the context of:

• Browsing and use of the arconlabs.io site.
• Requests for information, meetings or quotes through any channel.
• The execution of projects contracted with clients.
• The management of relationships with suppliers, partners and candidates.

The terms Data Subject (Titular), Processing (Tratamiento), Controller (Responsable), Processor (Encargado), Authorization (Autorización) and Sensitive Data (Dato Sensible) have the meaning established in Ley Estatutaria 1581 de 2012 and Decreto 1377 de 2013.

Personal data we collect

Arcon Labs collects only the personal data necessary to fulfil the purposes described in this policy. The following table summarizes what is collected, through which channel and for what purpose:

Sensitive data: Arcon Labs does not actively collect sensitive data (racial origin, sexual orientation, biometric data, health, etc.). If, in the course of a project, the client requires processing sensitive data of its own Data Subjects, this is documented in a specific data processing annex.

Purposes of the processing

The personal data collected is used exclusively for the following purposes:

• Handle requests for information, quotes and the scheduling of meetings.
• Perform the professional contracts signed with clients.
• Process course enrollment and payment, deliver the material and recordings, and handle the refunds offered.
• Manage invoicing, collections and the associated accounting and tax obligations.
• Maintain operational communication during and after a project.
• Send commercial communications only when the Data Subject has expressly authorized them.
• Comply with legal and regulatory obligations and requirements of competent authorities.
• Improve the quality of the site and of the services provided.

Legal basis and consent

The processing of personal data is carried out on the basis of:

• Authorization of the Data Subject granted at the time of providing their data (when scheduling a meeting, writing via WhatsApp, sending an email, etc.).
• Performance of a contract to which the Data Subject is a party, where the data is necessary to provide the contracted service.
• Compliance with legal obligations, in particular those of an accounting, tax and commercial nature.
• Legitimate interest of Arcon Labs to operate and protect the site, prevent fraud and keep minimal records of commercial interactions.
• Prior, express and informed consent for analytics and marketing cookies and technologies. These are not activated until the visitor accepts them in the notice that appears on entering the site, and the decision may be revoked at any time from the Cookie Policy. Declining them does not limit use of the site.

Processors and third parties with access

To operate, Arcon Labs uses services from technology providers that act as data processors. The following list identifies the main ones:

Arcon Labs verifies that these providers have reasonable security and data protection standards. When it is required to transfer project data to additional providers, this is documented and agreed with the client.

International transfers

Some of the data described in this policy may be processed and stored on servers located outside Colombian territory, mainly in the United States and in the European Union, due to the nature of the providers listed in section 06.

Course payment is the exception: it is processed by Wompi, a Colombian gateway of the Grupo Bancolombia, so those data do not leave national territory by that route.

By accepting this policy, the Data Subject expressly authorizes such international transfers, under the terms provided by article 26 of Ley 1581 de 2012, and acknowledges that Arcon Labs adopts reasonable measures to ensure that the providers offer adequate levels of protection.

Retention period

Personal data is kept only for the time necessary to fulfil the purposes described and, afterwards, to meet legal obligations:

• Leads without a contracted project: up to twenty-four (24) months from the last contact, unless there is a prior deletion request.
• Clients with an executed project: for the duration of the contract and for the applicable commercial and accounting limitation period (minimum ten (10) years, in accordance with the Colombian Código de Comercio).
• Course enrollees: during the course and for the period required by the accounting and tax obligations applicable to the payment received. Session recordings are kept for as long as the access offered to enrollees is maintained.
• Technical logs of the site: according to Vercel's retention policy.
• Visit statistics (Vercel Web Analytics): aggregated; the visitor hash is discarded after 24 hours.
• WhatsApp conversations: according to Meta's retention policy.
• Analytics and marketing data: according to the retention periods configured in Google Analytics 4 and in Meta. The record of your consent is stored only in your browser and is deleted when you clear the site's data or when you click «Change my preferences» in the Cookie Policy.

Rights of the Data Subject

Under Ley 1581 de 2012, the Data Subject has the following rights:

• Know: find out what data of theirs we process and for what purpose.
• Update and rectify: correct inaccurate or incomplete data.
• Request proof of the authorization granted for the processing.
• Access free of charge their data at least once per calendar month.
• Revoke the authorization or request deletion of the data, except where there is a legal or contractual duty requiring it to be kept.
• File complaints with the Superintendencia de Industria y Comercio (SIC).

How to exercise your rights

To exercise any of the above rights, the Data Subject may send a request to the email starboy@arconlabs.io, stating:

• Full name and identity document.
• Contact details for the reply.
• Clear description of the request (which right they wish to exercise and over what data).

Arcon Labs will respond within the following maximum periods:

• Queries: ten (10) business days, extendable by five (5) additional business days.
• Claims: fifteen (15) business days, extendable by eight (8) additional business days.

Information security

Arcon Labs applies reasonable technical, administrative and organizational measures to protect personal data against unauthorized access, alteration, loss or destruction. These measures include, without being limited to:

• Encryption in transit (HTTPS / TLS) in all communications of the site and services.
• Access control based on the principle of least privilege.
• Multi-factor authentication on the team's critical platforms.
• Backups and information recovery procedures.
• Periodic review of providers and permissions.

No security measure is absolute. In the event of an incident affecting personal data, Arcon Labs will apply the notification protocols provided by current regulations.

Minors

Arcon Labs' services are aimed exclusively at adults and, in particular, at authorized representatives of companies. We do not knowingly collect personal data from minors. If a parent or guardian identifies that a minor has provided their data without authorization, they may request immediate deletion by writing to the contact email indicated in this policy.

Changes to this policy

This policy may be updated at any time to reflect regulatory, operational or technological changes. The current version will always be the one published at this URL, with its update date visible in the header. Substantial changes will be communicated to the Data Subject through the usual channels before they take effect.

Contact and supervisory authority

For queries, claims or the exercise of rights related to personal data:

• Email: starboy@arconlabs.io
• Postal address: [EDIT: full postal address]

Without prejudice to the foregoing, the Data Subject may turn, as supervisory authority, to the Superintendencia de Industria y Comercio (SIC) of the Republic of Colombia, through www.sic.gov.co.