This policy applies to the processing of personal data of data subjects located in Colombia, under Law 1581 of 2012 and Decree 1377 of 2013 (compiled into Decree 1074 of 2015). It applies alongside — and does not replace — the platform privacy policy.
1. Identification
- Processor (Encargado del Tratamiento): AIRON TEAM SL
- Address: Plaza Mayor 23, 1.º A, 47001 Valladolid, España
- Tax ID: En trámite de asignación (sociedad de reciente constitución)
- PQRS channel: privacidad@airon.team (alternatively, info@airon.team)
Roles. AIRON acts as Encargado del Tratamiento on behalf of the Colombian customer company, which is the Responsable and owner of the database. The party answering to the data subject and to the Superintendency of Industry and Commerce (SIC) is, in the first place, that company.
2. Principles
The principles of Art. 4 of Law 1581 apply: legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security, and confidentiality.
3. Purposes
We process the data solely to deliver the contracted service to the customer company: reading and organising the connected sources, drafting replies with AI assistance, proposing actions, generating documents and keeping the audit trail. We do not use the data for our own purposes, for advertising, or to train models.
4. Authorisation
The Colombian regime requires the data subject’s prior, express and informed authorisation as a general rule, and does not recognise legitimate interest as a standalone basis. Obtaining and retaining that authorisation is the customer company’s duty as Responsable; AIRON supplies the model wording and the privacy notice for it to use in its own forms and channels.
5. Sensitive data and children’s data
The service does not request sensitive data or the data of children and adolescents. A data subject is under no obligation to authorise the processing of sensitive data. Because the platform synchronises mailboxes, such data may appear incidentally within a message: where it does, it remains subject to the same security and confidentiality measures and is not used for any additional purpose.
6. Data subject rights
- To know their data and how it is processed.
- To update and rectify partial, inaccurate or misleading data.
- To delete data where the legal grounds apply.
- To revoke the authorisation granted.
- To complain to the SIC after exhausting the consultation or claim before the Responsable.
7. PQRS channel and deadlines
- Consultation: 10 working days, extendable by a further 5 working days with justification.
- Claim (rectification, update, deletion, revocation): 15 working days, extendable by a further 8 working days.
- AIRON’s commitment as processor: when the Responsable passes us a request, we respond within 5 working days so that it can meet its own deadlines.
- Channel: privacidad@airon.team, stating name, identity document, contact details, the subject of the request and proof of identity.
8. International transmission
The data is processed on a server located in Frankfurt (Germany, European Union). Because AIRON acts as encargado, this is an international transmission, not a transfer. Regardless of whether Spain appears on the list of countries with an adequate level of protection under SIC Circular 005 of 2017, AIRON enters into an international transmission contract with each Colombian customer, containing the minimum clauses of Art. 25 of Decree 1377, and delivers the annex of its sub-processors with the country and function of each. The overall framework is the data processing agreement.
9. Security and incidents
The measures described in security measures apply, with the known gaps declared. In the event of a security incident, AIRON notifies the customer Responsable without undue delay, aiming not to exceed 48 hours — a deadline that leaves ample room for its own duty to report to the SIC within 15 working days.
10. Artificial intelligence
Colombia has no AI statute equivalent to the European Regulation. Even so, AIRON applies the same standard: the data subject knows they are interacting with an artificial intelligence, generated content is marked, and every outbound communication to a third party goes through human approval, save for an automatic mode that is declared in the message itself. We do not lower the product’s standard because we operate in a less demanding jurisdiction.
11. Validity
This policy is in force from 2 September 2026. Databases are kept for the duration of the contract with the customer company and for the periods stated in the platform privacy policy. Any amendment is published on this page and notified to customers 30 days in advance.