Privacy and Personal Data Policy

1. Controller and contact

Clave Marketing SAS, operating the Clave Marketing Digital brand in Colombia, controls the processing of inquiries received through this website. Privacy email: juanstorres@clavemarketingdigital.com. Phone: +57 321 991 9254. Responsible area: Strategic Direction / personal-data support.

The physical address for notices and tax identification number remain to be completed by the controller. The electronic support channel remains available.

2. Information we receive

The short banner and popup form collects your email and inquiry origin to contact you about a project, quote or marketing plan. The detailed inquiry form includes your name, company, email, optional phone/message, selected services, budget range, project intent and campaign origin when present in the link. If you choose to share Test Clave, its five answers and results are attached. We do not request patient or sensitive information.

The test can be used locally without contact details or checking boxes to begin. Its result is calculated in this browser; answers are not sent to the inquiry database until you choose to share them and submit the form with the corresponding authorizations. With analytics permission, coded interactions, score and indicative stage may be measured. Personal form fields, the message and its length are excluded from analytics events.

We receive minimal consent evidence: inquiry or preference identifier, separate decisions, server receipt time, browser-declared selection time where available, language, affirmative action, form context and document version, wording and hash. Infrastructure providers may process network metadata needed to deliver and protect the service.

3. Purposes and authorization

With your authorization, form details are used to understand your needs, reply, prepare and follow up a proposal, and communicate about that inquiry. We do not sell these details or subscribe you to advertising.

We also retain evidence of your decisions, handle data rights and applicable obligations, and protect against abuse. Spam controls temporarily use digests of technical data and email to limit repeated requests; a digest is not automatically anonymous.

Analytics is optional and has separate authorization in the cookie banner. You can reject it and still browse, use the test or request services. The first inquiry requires two separate boxes for terms of use and informed processing authorization. A current verified receipt may be reused for the same email, browser and purposes without checking the boxes again. Silence, scrolling and continued browsing are not consent.

4. Providers and international operations

We use OpenAI Sites hosting and Cloudflare infrastructure, including the database receiving inquiries and consent records. Access is limited to authorized staff who need it to handle inquiries or administer the service.

With analytics permission, authorized Google Analytics 4 and Amplitude tags may process technical information and interactions to assess website use and improve its journeys. Google Tag Manager manages these tags. Amplitude is configured for events defined by Clave, without form autocapture, free-text collection, session recordings or personalized advertising. Provider information is available at https://amplitude.com/privacy. Different providers or purposes require review and appropriate authorization.

Providers may operate outside Colombia. The controller must assess processing, confidentiality and security terms, document whether they act as processors or independent controllers, and verify the appropriate international transmission or transfer mechanism. A checkbox does not replace Article 26 requirements or applicable agreements. Information about recipients and safeguards may be requested.

5. Retention

This policy takes effect on November 1, 2026. The database exists while the stated purposes and applicable duties remain; this does not mean every record is kept indefinitely.

Inquiries that do not lead to a contractual relationship will be reviewed for deletion or anonymization after 24 months of inactivity. Client information follows the relationship and applicable legal retention periods. Minimal authorization evidence may be kept while necessary to demonstrate processing and handle obligations or claims.

Cookie preferences are remembered for up to 180 days, and requested again on expiry or a policy-version change. This is a website setting, not a general statutory period. Withdrawal stops future collection; it does not automatically erase previously received information. You can request deletion through the rights procedure.

6. Your rights

You may access, update and correct data, request proof of authorization and information about its use, request deletion or withdraw authorization where appropriate, and complain to the SIC after completing the applicable procedure with the controller. Access is free under the legal conditions.

Legal or contractual duties may require certain records to be retained despite a deletion or withdrawal request. Any necessary retention and its basis will be explained.

7. How to exercise rights

Email juanstorres@clavemarketingdigital.com with subject “Personal data”, your name, specific request and reply address. Include your inquiry or cookie-preference reference if available. We will request only proportionate identity or representation verification, avoiding unnecessary full identity documents.

Access inquiries are answered within 10 business days of receipt. An explained extension, with a reply date, may add no more than 5 business days.

Complaints are answered within 15 business days from the day after receipt; an explained extension may add no more than 8 business days. Missing information is requested within 5 days; failure to complete it for 2 months is treated as withdrawal of the complaint. If another party is competent, referral is made within 2 business days and the requester is informed.

8. Security and separate choices

We apply access controls, form validation, automated-abuse protection and decision recording. No system is incident-free; relevant incidents will be managed under applicable duties.

The first authorization uses two separate, initially unchecked boxes. A receipt can be remembered for up to 180 days from the original authorization for the same email, browser, version and purposes. The server verifies it before reuse and links the inquiry to the original evidence without claiming a new selection occurred. A different email or version, expiry or failed verification requires both boxes again. Reuse does not extend the original authorization date. Each decision is separately recorded and linked to the inquiry. Older records containing a general consent are not converted into acceptance of these new documents. Electronic evidence alone is not a certified digital signature.

9. Updates

The current version appears at the top of this document. Material changes will be communicated appropriately where required; new purposes require new authorization. You can request the version and evidence associated with your inquiry through the support email.