Personal data protection policy

1. Data controller

Interpoint Legal S.A.S. , tax ID 901.308.194-2, a company domiciled at Calle 100 # 8A-37, Oficina 701, Torre A, Edificio World Trade Center, Bogotá, Colombia, trading as Acevedo & Acevedo Abogados, acts as controller of the personal data collected through this website.

Channel for requests, queries and claims: [email protected]. As an alternative channel, WhatsApp +57 312 302 6666. Email is preferred because it leaves a dated written record of the request and of its answer.

2. Scope

This policy applies to the personal data of individuals processed by the firm in the course of its activity: clients, prospective clients who write through the site, counterparties, suppliers and candidates for the team. It does not cover processing carried out by third parties through sites linked from this one.

3. Legal framework

This policy is issued under article 15 of the Colombian Constitution, Law 1581 of 2012, Decree 1074 of 2015 — which consolidated Decree 1377 of 2013 — and any rules amending or supplementing them.

4. Definitions

• Data subject: the individual whose personal data is processed.
• Processing: any operation on personal data, including collection, storage, use, circulation or deletion.
• Controller: the party that decides on the database and its processing. In this policy, Interpoint Legal S.A.S..
• Processor: a party processing data on the controller's behalf, such as the site's hosting provider.
• Sensitive data: data affecting the subject's privacy or whose misuse could lead to discrimination. This site does not request it.
• Authorisation: the subject's prior, express and informed consent to the processing of their data.

5. Data collected

The contact form collects name, company, email address, telephone number and the description of the matter the data subject chooses to provide. No sensitive data and no data relating to minors are requested through this site.

The firm does not purchase databases nor incorporate data obtained from sources other than the data subject's own communication.

6. Purpose of processing

• Handling and responding to enquiries received.
• Assessing the viability of a possible professional engagement.
• Running conflict-of-interest checks before accepting a matter, as professional practice requires.
• Sending information about services and publications, subject to consent.
• Complying with applicable legal and contractual obligations.

Data is not sold, assigned or shared with third parties for commercial purposes.

7. Authorisation

Authorisation is obtained in advance, expressly and on an informed basis. Anyone submitting the contact form must tick the box accepting this policy; without that tick the form does not send. That acceptance, together with the date and content of the message, constitutes evidence of the authorisation granted.

The data subject may withdraw authorisation at any time through the channels above, except where a legal or contractual duty to retain the data applies.

8. Browsing data and web analytics

Site usage is measured with an analytics tool that sets no cookies, does not track visitors across sites and does not allow any individual to be identified. It records aggregate data only: page viewed, referring site, device type, browser and approximate country.

The site uses no advertising, profiling or social-media cookies, and shares no data with advertising platforms.

Hosting and protection of the site are provided by Cloudflare, Inc., acting as processor, which handles technical connection data — including the IP address — for the sole purpose of delivering the site and protecting it against attacks.

9. Rights of the data subject

Under article 8 of Law 1581 of 2012, the data subject has the right to:

• Access, update and rectify their personal data.
• Request evidence of the authorisation granted.
• Be informed of the use made of their personal data.
• File complaints with the Superintendence of Industry and Commerce for breaches of the law.
• Withdraw authorisation and request deletion where no legal or contractual duty to retain the data applies.
• Access their personal data free of charge.

10. How to exercise these rights

Queries and claims are received at [email protected], stating the data subject's name, a channel for the reply and a description of the facts. Queries are answered within ten (10) business days and claims within fifteen (15) business days, extendable as provided by law.

If a claim is incomplete, correction will be requested within the following five (5) days. If two months pass without a reply from the data subject, the claim is deemed withdrawn.

11. Security and retention

The firm adopts reasonable technical and administrative measures to protect data against unauthorised access, loss or alteration: access restricted to personnel who need it, encrypted transmission of the site and its forms, and a duty of confidentiality binding the whole team.

Data is retained for as long as the purpose that justified its collection subsists and, thereafter, for the period imposed by the document-retention obligations applicable to professional practice.

12. Professional confidentiality

Information provided by prospective clients through this site is treated as confidential. Sending a message through the form does not in itself create an attorney-client relationship, nor does it oblige the firm to take on the matter; until the engagement is expressly accepted, the information is not covered by legal professional privilege in its full sense, although the firm treats it with the same discretion.

13. Term

This policy applies from 4 September 2026. Any substantial amendment will be published on this same page with its new effective date. Databases are retained as set out in section 11.