Privacy Policy

1. Introduction

Guadua ("we", "our", or "the firm") is a business consulting and ESG advisory firm based in Bogotá, Colombia. This Privacy Policy explains how we collect, use, and protect personal information provided to us through our website at https://guaduapx.cyou and through our advisory services.

We take your privacy seriously and handle personal data with care and respect. This policy applies to all individuals who contact us, visit our website, or engage with our services.

Questions about this policy may be directed to [email protected].

2. Data We Collect

We collect personal information in the following ways:

2.1 Information you provide directly

• Full name
• Email address
• Phone number (when provided)
• Company name and role
• Message content submitted through contact forms

2.2 Information collected automatically

• Browser type and version
• Pages visited and time spent
• Referring URLs
• Device type and operating system
• IP address (anonymized where possible)

2.3 Legal basis for processing

We process personal data on the following legal bases: (a) your consent when submitting a contact form; (b) legitimate interest in responding to inquiries and improving our services; (c) performance of a contract when you engage our advisory services. Data collected is governed by Colombian Law 1581 of 2012 on the Protection of Personal Data and its regulatory decrees.

3. How We Use Your Data

Personal information collected is used for the following purposes:

• Responding to inquiries and service requests submitted through our contact form
• Scheduling and conducting advisory sessions
• Delivering written outputs and follow-up communications relating to engagements
• Improving the performance and content of our website
• Complying with legal obligations under Colombian law

We do not use your personal data for unsolicited marketing communications. If you have engaged our services and we believe a related service might be of interest to you, we may mention it in correspondence, but you may opt out at any time by writing to us.

3.1 Data retention

Contact form submissions are retained for up to 24 months. Client engagement records are retained for up to 5 years from the conclusion of the engagement, in accordance with Colombian commercial record-keeping requirements. After these periods, data is securely deleted.

4. Data Sharing

We do not sell personal data. We share personal information only in the following limited circumstances:

• Service providers: hosting, email, and analytics tools that process data on our behalf under appropriate contractual protections.
• Legal requirements: when required by Colombian law or lawful court orders.
• With your consent: when you have specifically agreed to a particular sharing arrangement.

Our website may use Google Analytics to understand aggregate visitor behavior. This data is anonymized and does not identify individual users. You may opt out of Google Analytics tracking by using the Google Analytics Opt-out Browser Add-on.

5. Data Protection

We implement appropriate technical and organizational measures to protect personal information from unauthorized access, loss, or disclosure. These measures include:

• HTTPS encryption for all website communication
• Access controls limiting data access to team members who need it for their role
• Secure, password-protected systems for storing client records
• Regular review of data access and security practices

In the event of a data breach that poses a risk to affected individuals, we will notify the relevant parties and the Superintendencia de Industria y Comercio (SIC) as required under Colombian law.

6. Cookies

Our website uses cookies to function correctly and to understand how it is used. Essential cookies are required for the site to work. Optional cookies for analytics and preferences can be declined. For full details on the cookies we use and how to manage them, please see our Cookie Policy.

7. Your Rights

Under Colombian Law 1581 of 2012, you have the following rights regarding your personal data:

• Right of access: to know what personal data we hold about you
• Right of rectification: to correct inaccurate or incomplete data
• Right of deletion: to request removal of your data, subject to legal retention obligations
• Right to revoke consent: where processing is based on your consent
• Right to complain: to the Superintendencia de Industria y Comercio (SIC) if you believe your rights have been violated

To exercise any of these rights, write to us at [email protected] with a clear description of your request. We will respond within 10 business days.

8. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies before sharing personal information with them.

9. Children's Privacy

Our services are intended for business organizations and professionals aged 18 and over. We do not knowingly collect data from individuals under 18. If we become aware that we have received such data, we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. When significant changes are made, we will update the date at the top of this page. Continued use of our website after changes are published constitutes acceptance of the updated policy.

11. Contact for Privacy Matters

For any questions or requests related to this Privacy Policy or your personal data: