Privacy and data processing policy

Last updated: November 4, 2026

This is a translation provided for convenience. If there is any discrepancy, the Spanish version prevails.

Cristian Moreno Jaramillo, sole proprietor (persona natural comerciante), Tax ID (NIT) 1000083882-6, domiciled in El Carmen de Viboral, Antioquia, Colombia is the data controller for the personal data collected through Vitrecia and this site, in accordance with Colombian Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and other Colombian data protection rules. Contact channel: soporte@vitrecia.com.

1. What data we process

• Sales contact: name, company, email and, if you provide them, phone, country and the message you send us in the forms. Only name, company and email are required.
• Account and portal: name, email, role, accounts, area, job title, country and language of each user your organization registers.
• Usage: sign-in records and reports viewed (who, which and when), IP address and technical browser data.
• Payments: card data is received and processed directly by Paddle.com; we only receive the payment status, the country and the transaction identifiers.

We do not request sensitive data (such as health, ethnic origin or political opinions) or data of children or adolescents. The content of Power BI reports is not stored in the portal: it is displayed directly from Microsoft services.

2. What we use it for

• To provide, maintain and secure the service, and to give support.
• To send you the emails the service needs: access, passwords, notifications you choose, account and free trial notices.
• To manage the subscription, billing and legal obligations.
• To answer requests and, only if you authorize it in the optional box, to send you news and tips about the product. You can withdraw this authorization at any time.

3. Authorization

We ask for your prior, express and informed authorization with a box separate from the acceptance of the terms, and the authorization for marketing communications is optional and unticked. We keep a record of the date, time, IP address, browser and version of this policy you accepted, so we can prove it when the law requires.

4. Who we share it with

• Microsoft (Entra ID, Power BI, Fabric and Azure), for sign-in and report display.
• Paddle.com, as merchant of record and payment processor.
• Brevo, to send the service emails.
• Cloud infrastructure and hosting providers acting as data processors.
• Authorities, when the law requires it.

Some of these providers are outside Colombia, so there may be international transfers or transmissions of data, which we carry out with the safeguards required by law. We do not sell your data.

5. Users of your organization's portal

For the users your organization registers in its portal, your organization is the data controller and we act as data processor: we process that data only to provide the service and according to its instructions. Your organization must have those people's authorization.

6. Your rights

As a data subject you can access, update and correct your data; request proof of the authorization; be informed about its use; revoke the authorization or request deletion when there is no legal or contractual duty to keep it; access your data free of charge; and file complaints with the Superintendence of Industry and Commerce (SIC) after completing the process with us.

7. How to exercise your rights

• Queries: use the requests and complaints form (it gives you a reference number) or write to us at soporte@vitrecia.com from the registered email or telling us how to verify your identity. We answer within 10 business days at most; if that is not possible, we tell you why and answer within 5 more business days at most.
• Claims (correction, update, deletion or revocation): include your identification, a description of the facts, the address or email to reply to and any documents you want to rely on. If the claim is incomplete we will ask you to complete it within 5 days; if 2 months pass without a reply, it is considered withdrawn. We answer within 15 business days at most, extendable by up to 8 more business days with notice of the reason.
• The person in charge of handling these requests is the service provider named at the start of this policy.

8. Security and retention

We apply technical and organizational measures to protect the data: encryption in transit (HTTPS), an isolated database per organization, one-way hashed passwords, encrypted credentials, role-based access control and activity logs. We keep the data while the business relationship exists and for the periods required by accounting and tax rules; data from requests that do not become customers is kept for 2 years at most.

9. Cookies

We only use necessary technical cookies and preference cookies. We do not use analytics or advertising cookies. Details are in the cookie policy.

10. Validity and changes

This policy applies from the update date shown above. We will publish any change on this page with its new date; if the change is substantial, we will notify you by email before applying it.