Privacy Policy

1. Who We Are

Bacatá is a business consulting practice registered in Bogotá, Colombia. Our registered address is Carrera 13 #93-40, Bogotá. We are the data controller for personal information collected through this website and through our client engagements. For privacy-related enquiries, contact us at [email protected].

2. What Personal Data We Collect

We collect the following categories of personal data:

• Contact information: name, email address, and telephone number — collected when you submit the contact form on this website or when you reach out to us directly.
• Communication content: the content of messages you send us, notes taken during advisory sessions, and documents you share with us as part of an engagement.
• Usage data: anonymised information about how visitors interact with this website, collected via cookies and analytics tools. This does not identify you personally unless you have provided your name or email.
• Business information: details about your organisation that you share as part of a consulting engagement — financial data, operational documents, staff structures — which we treat under strict confidentiality protocols.

3. Legal Basis for Processing

We process personal data under the following legal bases, in accordance with Colombian data protection law (Ley Estatutaria 1581 de 2012) and its regulatory decrees:

• Consent: when you submit the contact form or accept cookies on this site.
• Contractual necessity: when processing is required to deliver the advisory service you have agreed to.
• Legitimate interest: when we retain basic contact records for a reasonable period after an engagement to answer follow-up questions or resolve disputes.

4. How We Use Your Data

• Responding to enquiries submitted through the website.
• Scheduling and delivering advisory sessions.
• Preparing written summaries, plans, and roadmaps as part of engagements.
• Improving this website based on anonymised usage patterns.
• Complying with legal or regulatory obligations when required.

We do not use your data for automated decision-making or profiling. We do not send unsolicited marketing communications. If you would like to receive occasional updates from Bacatá, you may indicate this when contacting us.

5. Data Sharing

We do not sell, rent, or otherwise transfer personal data to third parties for commercial purposes. Data may be shared in the following limited circumstances:

• Service providers: we use third-party tools for website hosting, email, and analytics. These providers process data on our behalf and are required to protect it.
• Legal obligations: we may disclose data when required by Colombian law, court order, or government authority.
• Within engagements: during a Foundations Review, we may share interview summaries with your leadership group, but only with information drawn from their own sessions unless you have given explicit permission otherwise.

6. Cookies

This website uses cookies to understand how it is used and to remember your preferences. You can manage your cookie preferences at any time through our Cookie Policy page. Essential cookies necessary for the site to function are active regardless of your preference.

7. Data Retention

• Contact form enquiries: retained for 24 months from the date of submission, or until you request deletion.
• Client engagement records: retained for 5 years from the end of the engagement, in accordance with Colombian commercial record-keeping requirements.
• Analytics data: anonymised and aggregated; not linked to identifiable individuals.

8. Data Security

We apply appropriate technical and organisational measures to protect personal data from unauthorised access, loss, or disclosure. These include encrypted email communication for sensitive documents, password-protected file sharing for engagement materials, and restricted internal access to client information. In the event of a data breach affecting your rights, we will notify you as required by Colombian law.

9. Your Rights

Under Colombian data protection law, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate information.
• Erasure: request deletion of your data where there is no legitimate basis for continued processing.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: withdraw consent at any time where processing is based on consent. This does not affect the lawfulness of processing carried out before withdrawal.
• Complaint: lodge a complaint with the Superintendencia de Industria y Comercio (SIC), the Colombian data protection supervisory authority, at www.sic.gov.co.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframes required by law.

10. Third-Party Links

This website may include links to external resources. We are not responsible for the privacy practices of third-party sites and encourage you to review their policies directly.

11. Children's Privacy

Our services are directed at business owners and professionals aged 18 and over. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through this site, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy periodically to reflect changes in our practices or applicable law. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review the policy occasionally. Continued use of this website after changes are published constitutes acceptance of the updated policy.

13. Contact

For any questions about this policy or about how your data is handled, please write to: