Personal Data Processing Policy
Last updated: October 17, 2026 · MorSal S.A.S. (Inversiones MorSal S.A.S.)
This policy implements Article 15 of the Colombian Constitution, Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015), and sets the rules under which MorSal S.A.S. (legal name Inversiones MorSal S.A.S.) processes personal data in its databases. It complements the website Privacy Policy.
1. Controller identification
Controller: MorSal S.A.S. — legal name Inversiones MorSal S.A.S..
Domicile: Carrera 100 # 5-169, C.C. Unicentro Torre B, Piso 6, Cali, Valle del Cauca, Colombia.
Email: [email protected].
Phone/WhatsApp: +57 324 845 6110.
Area in charge of inquiries and claims: MorSal Personal Data Protection (same email).
2. Definitions
- Authorization: prior, express and informed consent of the data subject to process their personal data.
- Database: organized set of personal data subject to processing.
- Personal data: any information linked or linkable to identified or identifiable natural persons.
- Sensitive data: data affecting privacy or whose misuse may cause discrimination (e.g. health, racial or ethnic origin, political views, religious beliefs, sex life, biometrics).
- Processor: who processes personal data on behalf of the controller. Controller: who decides on the database and/or the processing.
- Data subject: natural person whose data is processed. Processing: any operation on personal data (collection, storage, use, circulation, deletion).
- Transfer: sending data to another controller inside or outside Colombia. Transmission: communicating data to a processor inside or outside Colombia on the controller’s behalf.
3. Principles
Processing follows the principles of Article 4 of Law 1581 of 2012:
- Legality, purpose (legitimate and informed), freedom (prior, express, informed consent);
- Truthfulness or quality: accurate, complete, up-to-date, verifiable data; transparency: the subject may obtain information about their data at any time;
- Restricted access and circulation; security (technical, human and administrative measures); confidentiality.
4. Processing and purposes by type of data subject
| Data subjects | Data | Purposes |
|---|---|---|
| Visitors and prospects | Name, company, email, service of interest, message, IP and technical data; analytics only with consent | Answer requests, prepare proposals, site security, statistical analytics (with consent), authorized commercial contact |
| Customers | Identification and contact of the customer and its representatives, billing and contract data, data needed to deliver the project | Perform contracts, invoice and collect, support, accounting and tax compliance, service communications |
| Suppliers and partners | Identification and contact, bank and tax data needed for payment | Contract and pay, verify performance, meet legal obligations |
Customer data we process on their behalf to build or operate software, SaaS or AI solutions is processed according to the customer’s instructions and the applicable contract.
5. Sensitive data and children
MorSal does not request sensitive data. If a project requires it, we will ask for express authorization stating that answering is optional and which data is sensitive (Article 6, Law 1581). We do not process data of children and adolescents except public data, within Article 7 of the Law and Decree 1377 of 2013, respecting their best interests.
6. Authorization: form and proof
Authorization is obtained before processing through verifiable means: acceptance box in the website form (with date/time log), email, message, written document or unequivocal conduct. We keep proof for the duration of processing and the applicable legal period.
Authorization is not required in the cases of Article 10 of Law 1581 of 2012: information requested by a public or administrative entity in the exercise of its functions or by court order; public data; medical or health emergencies; processing authorized by law for historical, statistical or scientific purposes; civil registry data.
7. Rights of data subjects
Data subjects have the rights in Article 8 of Law 1581 of 2012:
- know, update and correct their data before the controller or processors;
- request proof of authorization, except where the law does not require it;
- be informed, on request, of the use given to their data;
- file complaints with the SIC for infringements of the law;
- revoke authorization and/or request deletion when principles, rights and guarantees are not respected, or when the SIC finds infringements by the controller or processor;
- access their personal data free of charge, at least once per calendar month and whenever this policy is substantially modified.
8. MorSal’s duties as controller
Under Article 17 of Law 1581 of 2012 we commit to: guarantee the full exercise of habeas data; request and keep a copy of authorization; clearly inform the purpose and rights; keep information under necessary security conditions; ensure data given to processors is accurate, complete and current; rectify incorrect data and notify processors; require processors to respect security and privacy conditions; handle inquiries and claims within legal terms; adopt this policy and a handling procedure; flag disputed data; inform on request how data is used; and notify the SIC of breaches of security codes or risks in managing data subjects’ information.
9. Inquiry and claim procedure
Channel: [email protected], or a written communication addressed to MorSal — Personal Data Protection, Carrera 100 # 5-169, C.C. Unicentro Torre B, Piso 6, Cali, Valle del Cauca, Colombia. The requester must prove their identity (or that of their representative or successor) and state the request.
Inquiries (Art. 14): answered within ten (10) business days from receipt. If not possible, the requester is told why and the reply date, which may not exceed five (5) further business days.
Claims (Art. 15): must include the data subject’s identification, a description of the facts, an address and supporting documents. If incomplete, the requester is asked within five (5) days to complete it; after two (2) months without the information the claim is deemed withdrawn. Once complete, a “claim in process” note is added to the database within two (2) business days and kept until resolved. Maximum response time: fifteen (15) business days from the day after receipt; if not possible, reasons and a new date are given, not exceeding eight (8) further business days.
Prerequisite (Art. 16): the data subject may go to the SIC only after exhausting the inquiry or claim process with MorSal.
10. Revocation and deletion
The data subject may at any time request revocation of authorization or deletion of data, unless a legal or contractual duty requires it to remain in the database. Deletion means total or partial removal as requested. If revocation is total we stop processing for all purposes.
11. Security measures
We adopt reasonable technical, human and administrative measures, such as encrypted connections (HTTPS/TLS), role-based access and least privilege, authentication on administrative systems, backups, activity logging on critical systems, confidentiality agreements with staff and contractors, and provider vetting. In case of a security incident we will act as the law requires, notify affected data subjects and, where applicable, the SIC.
12. Processors, transmission and international transfer
For this website current processors include Cloudflare (DNS, CDN, security), EmailJS (form delivery), our web hosting and email provider, and Google (Google Analytics 4, only with consent). Some operate outside Colombia, so international transmission occurs under contract.
Data may also be transferred to our related company MorSal Technologies LLC (office: 1221 Brickell Avenue, Suite 900, Miami, FL 33131, EE. UU.; registered agent: 30 N Gould St Ste N, Sheridan, WY 82801, EE. UU.). Under Article 26 of Law 1581 of 2012 we do not transfer data to countries without adequate protection except with the data subject’s express, unequivocal authorization or other legal exceptions. By accepting this policy and submitting your data you grant that authorization for the stated purposes.
13. Database retention and registration
Databases are kept for the reasonable time needed for the purposes and legal duties. Where required under current regulations, MorSal will register its databases in the National Database Registry (RNBD) administered by the SIC and keep it updated.
14. Effective date and changes
This policy is effective from October 17, 2026. Substantial changes will be communicated on the website or by email before implementation, as Decree 1377 of 2013 requires. The current version is always available on this page.