Privacy and personal data processing policy

1. Who the controller is

• Controller: Cristian Quintero Rodriguez, identified with NIT 1019014289, operating under the Criquitech brand.
• Domicile: Bogotá D.C., Colombia. Address: Cra. 50 # 152-2, Bogotá.
• Email: contacto@criquitech.com. Phone: +57 311 577 1804.

This policy applies Colombian Law 1581 of 2012 and Decree 1377 of 2013, compiled in Decree 1074 of 2015. The Spanish version is the one that governs.

2. What data we collect

• What you type in the contact form on the site: your name, your email if you give it, and your message.
• The page and section you wrote from.
• The campaign parameters you arrived with, if you came from an ad or a tagged link: utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid (Google), fbclid (Meta) and li_fat_id (LinkedIn).
• Your WhatsApp number and what you write there, when you continue the conversation on that channel.

We do not ask for sensitive data or data about minors. If you send it without us asking, we delete it.

3. What we use it for

• Answering your request and continuing the conversation on WhatsApp or by email.
• Recording your request in our CRM to follow up commercially and send you a proposal if you ask for one.
• Knowing which campaign or channel brought you, to measure and improve our advertising.

We do not sell your data or use it for anything other than this.

4. Who we share it with

We use providers that process data on our behalf and under our instructions. Some are outside Colombia, mainly in the United States, so your data may be transmitted to another country:

• HubSpot: the CRM where your request is recorded.
• Amazon Web Services: the site hosting.
• Meta (WhatsApp): the channel where the conversation continues.
• Google (Google Ads) and LinkedIn (LinkedIn Ads): campaign measurement, through the cookies in section 6, only if you accept them.
• Google also receives your email, if you gave it and accepted cookies, hashed in your browser before it leaves, to match your request to the ad you saw (enhanced conversions). Google does not receive the email in readable form.

5. Your authorization

Next to the form submit button there is a notice linking to this policy. By sending the form you authorize us to process your data for the purposes in section 3: an unequivocal conduct, under Decree 1377 of 2013, art. 7.

We keep proof of that authorization with the date, time and policy version in force.

6. Cookies

The first time you visit, we ask whether you accept measurement cookies. None is loaded until you accept, and if you choose "Only necessary" they are never loaded.

• cq_consent, first-party and necessary: keeps your cookie choice for 180 days.
• cq_attr, first-party, measurement: keeps the campaign parameters you arrived with for 90 days, to attribute your request even if you browse other pages before writing.
• Google Ads, third-party, measurement: measures whether a Google ad ended in a request.
• LinkedIn Insight Tag, third-party, measurement: measures whether a LinkedIn ad ended in a request.

You can change your choice at any time from "Cookie preferences" at the bottom of every page, or delete cookies in your browser. The site works the same without measurement cookies.

7. Your rights

As the data subject you can, free of charge:

• Access, update and correct your data.
• Ask for proof of the authorization you gave us.
• Know how we have used it.
• Revoke the authorization or ask us to delete your data, unless a legal or contractual duty requires keeping it.
• File complaints with the Superintendencia de Industria y Comercio, after making your inquiry or claim with us.

8. How to exercise them

Write to contacto@criquitech.com with your name, the contact detail you wrote to us with, and your request. It is handled by Cristian Quintero Rodriguez.

Inquiries: answered within 10 business days at most. If we cannot, we tell you why and answer within 5 more business days at most.

Claims (correction, update, deletion or breach): answered within 15 business days from the day after we receive them. If we cannot, we tell you why and answer within 8 more business days at most. If a claim is missing information, we ask for it within the next 5 days; if you do not send it within 2 months, we understand you withdrew it.

9. Security and retention

We process your data with reasonable technical and access measures to prevent loss, unauthorized access or misuse.

We keep it while it is needed for the purposes in section 3, or until you ask us to delete it and no duty to keep it applies.

10. Effective date and changes

This policy is in force since September 24, 2026. If we change it substantially, we publish it on this page with the new date before applying it.