Opens in a new tab

Legal

PERSONAL DATA PROCESSING POLICY
FOR CUSTOMERS AND PROSPECTIVE CUSTOMERS

Date: October 01, 2026

This document constitutes the Personal Data Processing Policy for customers and prospective customers adopted by AUTOVENZ SAS in compliance with applicable regulations. Its purpose is to establish the rules governing the collection, storage, use, disclosure, updating, access to, and deletion of personal information obtained in the course of commercial activities and credit-risk assessment and management processes.

1. INTRODUCTION

This Policy is the document adopted by AUTOVENZ SAS to govern the processing of personal data belonging to customers and prospective customers, particularly information collected through commercial forms, digital channels, WhatsApp communications, and other contact methods, as well as information used to assess credit applications, establish credit limits and commercial terms, and monitor payment behavior.

2. IDENTIFICATION OF THE DATA CONTROLLER

  • LEGAL NAME: AUTOVENZ SAS
  • TAX ID (NIT): 901149777-3
  • PRINCIPAL DOMICILE: Medellín
  • ADDRESS: CR 52 79 SUR 48 BG 107
  • TELEPHONE: 3163807086
  • EMAIL FOR HABEAS DATA / DATA PROTECTION MATTERS: [email protected]

3. APPLICABLE LEGAL FRAMEWORK

This Policy is based on Article 15 of the Political Constitution of Colombia; Statutory Law 1581 of 2012; Law 1266 of 2008, insofar as applicable to financial, credit, commercial, and service information; Law 2300 of 2023 concerning channels and conditions for contacting consumers; Decree 1074 of 2015; and any other rules that amend, supplement, replace, or regulate them.

4. DEFINITIONS

Authorization: Prior, express, and informed consent from the Data Subject to process their personal data.

Database: An organized collection of personal data that is subject to Processing.

Customer: An individual who purchases or has purchased products or services from AUTOVENZ SAS, or an individual whose data is processed in connection with or as a contact for a corporate customer, where such data identifies that individual.

Prospective Customer: An individual who expresses an interest in AUTOVENZ SAS products or services or provides their information to receive commercial information.

Personal Data: Any information relating to, or that can be associated with, one or more identified or identifiable individuals.

Semi-Private Data: Data that is neither intimate, confidential, nor public in nature, and whose disclosure may be of interest to the Data Subject and to a specific sector or group of persons, such as financial, credit, commercial, or service information.

Data Processor: An individual or legal entity that processes personal data on behalf of the Data Controller.

Data Controller: An individual or legal entity that makes decisions regarding the database and/or the processing of personal data.

Data Subject: An individual whose personal data is subject to Processing.

Processing: Any operation performed on personal data, including collection, storage, use, disclosure, updating, or deletion.

5. PRINCIPLES GOVERNING DATA PROCESSING

  • Legality: Processing shall be carried out in accordance with applicable legal provisions.
  • Purpose: Data shall be processed only for legitimate, specific purposes that have been disclosed to the Data Subject.
  • Freedom: Except where permitted by law, Processing shall require the Data Subject’s prior, express, and informed authorization.
  • Accuracy and Quality: Information must be truthful, complete, accurate, up to date, verifiable, and understandable.
  • Transparency: The Data Subject may obtain information about the existence and use of their data.
  • Restricted Access and Disclosure: Data shall be processed only by authorized persons and within the limits of the purpose disclosed to the Data Subject.
  • Security and Confidentiality: Reasonable measures shall be adopted to prevent alteration, loss, unauthorized or fraudulent consultation, use, or access.
  • Necessity and Proportionality: Only data that is relevant and appropriate for the applicable commercial or credit-related purpose shall be collected.

6. DATA SUBJECTS AND CATEGORIES OF INFORMATION

This Policy primarily applies to individual customers and prospective customers, as well as representatives, contacts, administrators, owners, or other individuals associated with corporate customers, when the information processed makes it possible to identify an individual.

Depending on the relationship and purpose, AUTOVENZ SAS may process, among others, the following data:

  • Identification and contact data: name, city, telephone number, email address, and other information provided by the Data Subject.
  • Commercial data: business name, business activity, city of operation, products of interest, and estimated purchase volume or frequency.
  • Data relating to the commercial relationship: purchases, invoicing, accounts receivable, payments, fulfillment of obligations, length of the relationship, and historical behavior.
  • Financial, credit, commercial, or service information necessary to assess credit applications, where its processing is authorized or otherwise permitted by law.

7. PURPOSES OF PROCESSING

Personal data belonging to customers and prospective customers may be processed, as applicable, for the following purposes:

  1. Receive, record, and manage information submitted through commercial forms, landing pages, physical forms, digital channels, or other mechanisms made available by AUTOVENZ SAS.
  2. Contact the Data Subject by telephone, email, WhatsApp, or other authorized channels to respond to inquiries, provide additional information, prepare quotations, and offer products or services.
  3. Carry out marketing, advertising, commercial prospecting, customer loyalty activities, campaigns, promotions, satisfaction surveys, and communications relating to AUTOVENZ SAS products or services, always with the authorization required by law and respecting the Data Subject’s requests not to receive commercial communications.
  4. Manage the pre-contractual, contractual, and commercial relationship, including orders, deliveries, invoicing, customer service, warranties, accounts receivable, and payment collection.
  5. Assess credit applications and evaluate the customer’s capacity, profile, and payment behavior for the purpose of approving, denying, maintaining, modifying, or cancelling credit limits and determining credit terms, payment periods, and other commercial conditions.
  6. Review and analyze purchase history, payments, delinquencies, agreements, and other information arising from the direct commercial relationship with AUTOVENZ SAS for credit-risk management and prevention purposes.
  7. Where applicable and where the corresponding authorization or legal basis exists, consult, verify, update, or otherwise process financial, credit, commercial, and service information obtained from information operators or sources, in accordance with Law 1266 of 2008 and other applicable regulations.
  8. Prevent fraud, impersonation, non-compliance, and other risks associated with commercial and credit transactions.
  9. Respond to habeas data requests, inquiries, and complaints, as well as requests from administrative or judicial authorities.
  10. Comply with legal, accounting, tax, contractual, and document-retention obligations.

8. SPECIAL RULES FOR COMMERCIAL CONTACT AND MARKETING

  • Providing data through a commercial form does not, by itself, constitute automatic authorization for every purpose. AUTOVENZ SAS shall obtain and retain evidence of the prior, express, and informed authorization required for each applicable purpose.
  • Commercial communications shall be sent only through channels authorized by the Data Subject and in compliance with applicable legal requirements concerning contact hours, frequency, and communication channels.
  • The Data Subject may at any time request that the use of their data for advertising, marketing, or commercial prospecting purposes cease, without affecting Processing that must continue due to a legal or contractual obligation.
  • Digital forms shall include a clear authorization mechanism, without pre-checked boxes, together with access to this Policy or the applicable privacy notice.

9. PROCESSING OF INFORMATION FOR CREDIT-RISK ASSESSMENT

  • AUTOVENZ SAS may use information arising from its own commercial relationship with the customer—including purchase history, payments, delinquencies, agreements, and fulfillment of obligations—to assess the risk associated with granting and maintaining credit, within the limits of the authorization provided and applicable regulations.
  • When third-party information, credit bureaus, or information operators are consulted for credit assessment, the special rules applicable to financial, credit, commercial, and service information shall be followed, including requirements concerning authorization, accuracy, updating, restricted disclosure, and the exercise of Data Subject rights, where applicable.
  • Credit decisions may take into account objective criteria related to payment behavior, purchase volume, length of the relationship, level of exposure, and other legitimate risk variables. Information shall not be used for purposes incompatible with those disclosed to the Data Subject.
  • Credit approval does not constitute a vested right and remains subject to AUTOVENZ SAS’s internal risk policies and commercial assessment, without prejudice to the Data Subject’s rights concerning their personal data.

10. RIGHTS OF DATA SUBJECTS

  • Know, update, and correct their personal data.
  • Request evidence of the authorization provided, except where legally exempt.
  • Upon request, be informed about how their data has been used.
  • Submit inquiries and complaints and, once the applicable procedure has been exhausted, approach the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio) in the cases provided by law.
  • Revoke their authorization and/or request deletion of their data when legally permitted.
  • Access, free of charge, their personal data subject to Processing.
  • Request that commercial or marketing communications directed to their contact information be suspended.

11. AUTHORIZATION AND EVIDENCE OF AUTHORIZATION

Except for the exceptions established by law, AUTOVENZ SAS shall obtain the Data Subject’s prior, express, and informed authorization. Authorization may be obtained through physical, electronic, or digital means, or through unequivocal conduct from which it can reasonably be concluded that authorization was given, provided that verifiable evidence of such authorization exists.

AUTOVENZ SAS shall retain evidence of the authorizations obtained and of the information provided to the Data Subject at the time authorization was obtained.

12. PRIVACY NOTICE

When it is not possible to make this Policy available to the Data Subject at the time the information is collected, AUTOVENZ SAS shall provide a privacy notice containing, at a minimum, the identity and contact information of the Data Controller, the purposes of Processing, the Data Subject’s rights, and the manner in which this Policy may be consulted.

13. DATA PROCESSORS, TRANSFERS, AND THIRD PARTIES

AUTOVENZ SAS may engage technology providers, messaging platforms, CRM systems, hosting services, advisors, collection service providers, or other third parties acting as Data Processors. In such cases, contractual and security measures shall be implemented to ensure that data is processed only in accordance with AUTOVENZ SAS’s instructions and for the authorized purposes.

Where national or international transfers or transmissions of data take place, the requirements established under applicable Colombian regulations shall be observed.

14. RESPONSIBLE AREA AND CONTACT CHANNELS

The person responsible for handling habeas data inquiries and complaints is Jorge Alberto Briceño – Alternate Legal Representative.

  • Email: administració[email protected]
  • Physical address: CR 52 79 SUR 48 BG 107
  • Telephone, if applicable: 3163807086

15. PROCEDURE FOR INQUIRIES AND COMPLAINTS

Inquiries. Inquiries shall be addressed within a maximum of ten (10) business days from receipt. If it is not possible to respond within that period, the interested party shall be informed of the reason for the delay and the new response date, which may not exceed five (5) business days following the expiration of the initial period.

Complaints. When the Data Subject believes that information should be corrected, updated, or deleted, or identifies a possible violation, they may submit a complaint including their identification, a description of the facts, contact information, and any documents they wish to rely upon.

If the complaint is incomplete, the interested party will be asked to correct or complete it within five (5) business days following receipt. Once complete, the complaint shall be addressed within fifteen (15) business days. If it is not possible to respond within that period, the reason and the response date shall be provided, without exceeding an additional eight (8) business days.

16. DATA DELETION AND REVOCATION OF AUTHORIZATION

The Data Subject may request deletion of their data or revoke their authorization in accordance with the complaint procedure. The request shall not apply to information that must be retained by legal or contractual obligation, nor where a legitimate purpose remains that prevents its immediate deletion.

17. SECURITY AND CONFIDENTIALITY

AUTOVENZ SAS shall adopt reasonable administrative, technical, and organizational measures to protect information against loss, alteration, unauthorized or fraudulent consultation, use, or access. Access to commercial and credit information shall be limited to personnel and third parties who require it to perform their functions.

18. EFFECTIVE DATE AND DATABASE RETENTION

This Policy is effective as of October 1, 2026. Databases shall remain in effect for the reasonable and necessary period required to fulfill the stated purposes and applicable legal or contractual obligations. Material changes shall be communicated through appropriate means when required.

_______________________________________
EDDY ANTONIO MIRANDA REYES
LEGAL REPRESENTATIVE
AUTOVENZ SAS