How we handle personal data.

Data controller:Cloudcity Colombia SAS, Colombian tax ID (NIT) 901.249.716, headquartered in Bogotá D.C., Colombia, with operations in Lima (Peru) and USA (United States). Contact: info@cloudcity.com.co · +57 318 201 1697.

This policy describes how we collect, use, share and protect personal data when you visit https://cloudcity.com.co, communicate with us (forms, email, WhatsApp, Cloud IA) or use our services.

1. Scope and roles

Cloudcity acts as the controller for data of site visitors, prospects and business contacts. When we operate AI agents, software or infrastructure on behalf of a client, we act as a processor: the data belongs to the client and is governed by that client's contract and instructions.

2. Legal framework

• Colombia: Statutory Law 1581 of 2012 (Habeas Data), Decree 1377 of 2013 (compiled into Decree 1074 of 2015) and related rules. Authority: Superintendence of Industry and Commerce (SIC).
• Peru: Personal Data Protection Law No. 29733 and its Regulations (Supreme Decree No. 016-2024-JUS). Authority: National Authority for Personal Data Protection (ANPD).
• United States: applicable federal and state laws, including Section 5 of the FTC Act, COPPA (children under 13) and, where applicable, the California CCPA/CPRA.
• European Union / EEA: the General Data Protection Regulation (GDPR) when we process data of individuals in the Union.

3. Data we process

• Identity and contact: name, email, phone, company and role, when you provide them through forms, email or WhatsApp.
• Business data: project needs, communication history and contracting records.
• Technical and usage data: preferred language, cookie decision, IP address, browser type and access logs needed for security and diagnostics.
• Cloud IA conversations: messages you write to the assistant may be logged to operate and improve the service. Do not enter sensitive data or third-party confidential information.
• Data processed on behalf of clients: data our clients entrust to us when we operate their agents, software or infrastructure.

4. Purposes and legal bases

• Handling requests, questions and commercial inquiries.
• Entering into and performing service contracts.
• Complying with legal, accounting, regulatory and contractual obligations.
• Sending service-related communications, with your prior consent.
• Securing the site and our infrastructure.
• Improving our services using aggregated or anonymized information.

We process data based on your prior, express and informed consent (Colombia and Peru), the performance of a contract, compliance with legal obligations and, for individuals in the EU/EEA, properly balanced legitimate interest (Art. 6 GDPR).

5. Your rights

Colombia (Law 1581 of 2012)

• Know, update, rectify and delete your data.
• Request proof of the consent granted and revoke it.
• File complaints with the SIC (www.sic.gov.co) once the request to Cloudcity has been exhausted.
• Timeframes: inquiries within 10 business days; claims within 15 business days.

Peru (Law No. 29733)

• Rights of access, rectification, cancellation and objection (ARCO), and to information about the processing.
• Complaint before the ANPD if we do not respond within the legal terms.

European Union / EEA (GDPR)

• Access, rectification, erasure, restriction, portability and objection, including objection to solely automated decisions.
• Response within one month and the right to contact your supervisory authority.

United States (California — CCPA/CPRA)

• Know, delete and correct the personal information we hold about you.
• Opt out of the "sale" or "sharing" of your information. Cloudcity does not sell personal data.
• Limit the use of sensitive information and not be discriminated against.

6. Children

Our services are not directed at children. We only process data of minors with the authorization of their legal guardian, respecting their best interest (Colombia) and, in the US, COPPA requirements for children under 13. In education products we apply reinforced Habeas Data rules for minors.

7. Information security

We apply technical and organizational controls aligned with ISO 27001 (certification in progress): encryption in transit, least-privilege access control, audit logs, 3-2-1 backups and environment segregation. For clients with sovereignty requirements we offer storage exclusively in our datacenter in Colombia.

8. Retention

We keep data for as long as the purpose that justified its collection or the contractual relationship exists, and afterwards only for the periods required by legal, accounting or litigation-defense obligations. Once those periods expire, we delete or anonymize it.

9. International transfers

By default, personal data is hosted in Colombia. Transfers between our offices (Colombia, Peru and the US) and to vendors take place under contracts with protections equivalent to those of the origin country. For data of individuals in the EU/EEA we use Standard Contractual Clauses (SCCs) or another valid mechanism under Chapter V of the GDPR.

10. Processors and third parties

We share data only with vendors that provide services to us (infrastructure, communications, messaging such as WhatsApp/Meta) under processing agreements, with authorities when required by law, and never for the sale or rental of databases.

11. Cookies

The use of cookies and similar technologies, and the category-based consent system, are described in the Cookie policy. You can change your decision at any time via "Cookie preferences" in the footer.

12. How to exercise your rights

Write to info@cloudcity.com.co with the subject "Personal data", stating your name, the right you are exercising and the facts behind your request. We may ask for reasonable identity verification. We respond within the timeframes of the applicable jurisdiction (section 5).

13. Changes to this policy

We may update this policy to reflect regulatory or operational changes. The current version will always be published on this page with its update date and, for substantial changes, we will notify through our usual channels.