PRIVACY POLICY

CONTROLLER

Controller and scope

Resuelve Consultoría de Impacto Social S.A.S. is the controller for personal data processing in its digital and operational channels. This policy covers commercial, contractual and support interactions.

When processing involves data subjects in the EU/EEA, including Germany, we apply GDPR standards and complementary German rules. In Colombia we apply the national habeas data and data protection framework.

LEGAL FRAMEWORK

Applicable legal framework

Processing is based on the GDPR, BDSG and TDDDG for the EU/Germany, and on Law 1581 of 2012, Decree 1377 of 2013, Decree 1074 of 2015 and Law 1266 of 2008 where applicable in Colombia.

CATEGORIES

Data categories and purposes

We may process identification and contact data, professional and organizational data, technical browsing data, communications and operational metadata. Purposes include request management, contractual performance, legal compliance, security, service improvement and authorized communications.

LEGAL BASES

Legal bases for processing

Legal bases include performance of pre-contractual steps, compliance with legal obligations, legitimate interest with minimization measures, and consent for non-essential communications or non-technical analytics. For sensitive data or minors, we apply reinforced controls and explicit consent when required.

COOKIES

Cookies and similar technologies

We use strictly necessary cookies or tags for site operation and security. Non-essential cookies require prior, free and informed consent unless legal exceptions apply. You can manage preferences in your browser, through the consent tool or from “Cookie preferences” in the site footer.

TRANSFERS

International transfers

If we transfer data outside Colombia or the EEA, we apply equivalent contractual, technical and organizational safeguards, including standard contractual clauses where applicable and valid transfer mechanisms under the relevant rules.

RETENTION

Retention and deletion

We retain data only for the time necessary for the stated purpose, legal obligations or defense of claims. Afterwards we apply secure deletion or irreversible anonymization.

RIGHTS

Data subject rights and timelines

You may request access, rectification, updating, deletion, withdrawal of consent, objection, restriction of processing and portability where applicable. Under the GDPR, we generally respond within 1 month; in Colombia, we apply the legal timelines for queries and complaints.

UNITED STATES / CALIFORNIA

California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, grants you the right to know and access the personal information we collect, to delete and correct it, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights.

We do not sell your personal information and do not share it for cross-context behavioral advertising, and we do not use sensitive personal information for purposes that would require an opt-out under the CPRA.

To exercise your rights, write to proyectos@resuelve.com.co; we may need to verify your identity and you may use an authorized agent. We respond, as a general rule, within 45 days. Authorities: the California Privacy Protection Agency (CPPA) and the California Attorney General.

SECURITY

Security and incident management

We implement reasonable technical and organizational controls, such as encryption, access control, least privilege, reinforced authentication and monitoring. For incidents involving risk, we activate response, documentation and notification protocols when required by law.

AUTHORITIES

Supervisory authorities and references

References include the SIC in Colombia, EDPB data protection authorities, the BfDI in Germany, the GDPR text, BDSG, TDDDG, Law 1581 of 2012 and Decree 1377 of 2013.

UPDATES

Updates to this policy

This policy is reviewed periodically and may be updated to reflect regulatory, technological or operational changes. The current version will always be the one published on this page.