1. Data controller
- Company
- Barona Enterprise
- NIT
- 901.402.517-1
- Registered office
- Bogotá D.C. (Colina area), Colombia
- Also operating in
- Villeta, Cundinamarca
- Phone and WhatsApp
- +57 324 669 4053
- info@baronaenterprise.com
- Office hours
- Monday to Friday, 8:00 AM to 5:00 PM (Colombia time)
- Website
- baronaenterprise.com
Contact point for data subjects: Personal Data Desk, at info@baronaenterprise.com (subject “Personal data”), by phone at +57 324 669 4053 or through the PQRS form.
2. Definitions
- Data subject: the individual whose data is processed.
- Personal data: information linked to an identified or identifiable individual.
- Sensitive data: data affecting privacy or that may lead to discrimination (health, ethnic origin, political or religious views, biometrics, among others).
- Processing: any operation on personal data (collection, storage, use, circulation or deletion).
- Controller / Processor: who decides on the processing / who carries it out on the controller’s behalf.
- Transfer / Transmission: sending data to another controller / communicating data to a processor to handle on the controller’s behalf.
3. Principles
We apply the principles of legality, purpose limitation, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality in article 4 of Law 1581 of 2012: we only ask for what is needed, for stated purposes and with your authorization.
4. Data we process and how we obtain it
| Channel | Data |
|---|---|
| Microsoft Teams booking | Name, company, email, phone (optional), reason and the description you write. We use it to create the meeting in our Microsoft 365 calendar, which sends you the invitation. We also keep a record of your authorization: date and time, policy version, form, name, email and IP address. |
| Tech newsletter | Email address, language, subscription date and the record of your authorization (date, policy version and IP address). |
| WhatsApp contact forms | The site only prepares the message on your device; you decide whether to send it. What you send us by WhatsApp, email or phone is used to assist you. |
| Complaints and requests (PQRS) | Request type, name, ID number (if provided), email, phone and the description of your request, which you send us by email or WhatsApp. |
| Confidential document room | When we invite you to review a confidential document: name, ID type and number, company, mobile number, date and time, IP address, browser, pages viewed and the record of your acceptance of the confidentiality undertaking. |
| Clients and suppliers | Contact and billing data and whatever is needed to perform the contract and meet accounting and tax obligations. |
| Technical data | IP address, date and path of requests, used temporarily for site security and abuse limits. We use no third-party analytics or advertising (see the cookie policy). |
The express assessment, the “Design your Microsoft ecosystem” selector and the “Help me choose” assistant are calculated in your browser and never sent to any server. We do not request sensitive data or data about minors on the site; please do not include them in the forms.
5. Purposes
- Scheduling and holding meetings, inquiries, quotes and proposals.
- Entering into and performing contracts, providing services, invoicing, collecting payments and meeting legal, accounting and tax obligations.
- Sending the tech newsletter and communications about our services and products, only if you authorized it; you can withdraw at any time.
- Handling requests, complaints, claims and personal data requests.
- Protecting site security, preventing fraud and abuse, and keeping proof of authorizations and acceptances.
- Controlling access to confidential documents and keeping a trail of their consultation.
- Responding to requests from competent authorities.
We do not sell, rent or assign personal data, nor use it for third-party advertising.
6. Authorization
We ask for your prior, express and informed authorization through the consent box on each form, which links to this policy, and we keep proof of it (date and time, policy version, form and IP address). Authorization is not required in the cases of article 10 of Law 1581 of 2012, such as public data or requests from authorities.
7. Your rights
- Access, update and correct your personal data.
- Request proof of the authorization granted.
- Be informed, on request, about how your data has been used.
- File complaints with the Superintendence of Industry and Commerce (SIC) for breaches of the law, after completing the request or claim process with us.
- Withdraw your authorization and request deletion of your data, when there is no legal or contractual duty to keep it.
- Access your personal data free of charge, at least once every calendar month and whenever this policy changes substantially.
These rights may be exercised by the data subject, their successors, representative or attorney, and whoever acts on another’s behalf by agreement, upon proving their standing.
8. Requests and claims procedure
Channels: info@baronaenterprise.com (subject “Personal data”), phone and WhatsApp +57 324 669 4053, or the PQRS form. Include your name, ID number, the specific request, any supporting documents and a way to reply to you.
- Requests (consultas): answered within ten (10) business days of receipt. If that is not possible, we tell you why and the new date, which will not exceed five (5) additional business days.
- Claims (reclamos) (correction, update, deletion, withdrawal or alleged breach): answered within fifteen (15) business days from the day after receipt, extendable by up to eight (8) business days with notice of the reason. If a claim is incomplete, we will ask you to complete it within five (5) days; if two (2) months pass without completion, it will be deemed withdrawn. While it is resolved, the data will be flagged “claim in progress” within two (2) business days of receipt.
9. Transmission and transfer of data, including internationally
To operate we use providers acting as data processors, under contracts with confidentiality and security obligations:
- Microsoft (Microsoft Azure, where the site is hosted and records are stored, and Microsoft 365, where email and the meeting calendar are managed). Its datacenters may be located outside Colombia, mainly in the United States of America, a country the SIC recognizes as providing an adequate level of data protection; Microsoft also provides contractual data protection commitments for its cloud services.
- Google Fonts, which serves the site’s typefaces and may log your technical IP address when doing so.
- WhatsApp (Meta), only when you choose to message us through that channel, under its own terms.
By accepting this policy you authorize the transmission and, where applicable, the international transfer of your data to these providers for the purposes described. We also share data with authorities when a regulation or order requires it.
10. Security
We apply technical, human and administrative measures proportionate to the risk: encrypted connections (HTTPS with HSTS), a content security policy that blocks third-party scripts, form validation and abuse limits, credentials kept out of the code, restricted least-privilege access, and data stored outside the site’s public folder. More in the security policy.
11. Retention
We keep data only as long as needed for its purpose: business contacts who do not become clients, up to two (2) years after the last contact; clients, during the relationship and up to ten (10) years afterwards to support accounting and tax obligations; newsletter data, until you unsubscribe; authorization records, while we process your data and for the limitation period of related actions; and technical security logs, for short periods. Afterwards we delete or anonymize it.
12. Minors
The site and services are aimed at businesses and adults. We do not knowingly collect data from minors; if we receive it, we delete it.
13. National Database Registry
Barona Enterprise registers its databases in the SIC’s National Database Registry when the law requires it.
14. Effective date and changes
This policy (version 2026.10) is effective as of October 7, 2026. Databases will remain in force while the stated purposes apply. Substantial changes will be published on this page before they take effect and, if they involve new purposes, we will ask for new authorization.
