Personal Data Processing Policy

Data controller (responsable del tratamiento)

Xpansive, a software studio domiciled in Bogotá D.C., Colombia, is the responsable del tratamiento (data controller) of the personal data collected through this website.

Contact channel for all data-protection matters: hola@xpansive.co.

Legal framework

This policy is issued under articles 15 and 20 of the Colombian Political Constitution, Ley Estatutaria 1581 de 2012, and its regulatory decree — Decreto 1377 de 2013, today compiled in Decreto 1074 de 2015 — together with the doctrine of the Superintendencia de Industria y Comercio (SIC).

Definitions

Personal data (dato personal): any information linked or linkable to an identified or identifiable natural person. Data subject (titular): the natural person whose data is processed. Processing (tratamiento): any operation on personal data — collection, storage, use, circulation, or deletion.

Authorization (autorización): the prior, express, and informed consent of the data subject. Controller (responsable): who decides on the processing — here, Xpansive. Processor (encargado): who processes data on the controller’s behalf, such as our infrastructure and AI providers.

Data processed and purposes

Through the contact form we process name, email, company (optional), message (optional), and page language, in order to respond to commercial inquiries and, where a conversation follows, prepare proposals.

Through the talent form we process name, email, phone, LinkedIn profile URL, an optional free-text story, an optional CV or LinkedIn-profile PDF, and page language, in order to evaluate candidacies and manage the selection process.

Application text and CVs are additionally processed by Claude, an AI model provided by Anthropic acting as encargado, which produces a structured summary (skills, roles, education, highlights) to support human review. No decision with legal effects is automated: a person reviews every application.

Principles

All processing observes the principles of Ley 1581 de 2012: legality (legalidad), purpose (finalidad), freedom (libertad), truthfulness or quality (veracidad), transparency (transparencia), restricted access and circulation (acceso y circulación restringida), security (seguridad), and confidentiality (confidencialidad).

Rights of data subjects

Every titular may: conocer — know the data we hold and how it is processed; actualizar — update data that is incomplete or out of date; rectificar — correct inaccurate data; suprimir — request deletion when the processing does not respect the law’s principles, rights, and guarantees; and revocar — revoke the authorization granted, where no legal duty requires us to keep the data.

Data subjects may also file complaints before the Superintendencia de Industria y Comercio (SIC), once they have first exhausted the consulta or reclamo procedure before Xpansive.

Inquiries and claims (consultas y reclamos)

Consultas: any titular may ask what data of theirs we process by writing to hola@xpansive.co. We respond within ten (10) business days of receipt; if that is not possible, we will state the reasons and answer within the following five (5) business days, as article 14 of Ley 1581 de 2012 provides.

Reclamos: requests to correct, update, or delete data, or reports of an alleged breach of the law, must include the titular’s identification, a description of the facts, an address for response, and any supporting documents. We respond within fifteen (15) business days; if more time is needed, we will inform the titular and answer within the following eight (8) business days, per article 15 of Ley 1581 de 2012.

An incomplete reclamo will prompt a request for completion within five (5) days of receipt; two (2) months without an answer from the claimant is understood as withdrawal, as the law provides.

Area responsible for data protection

Xpansive’s management area is responsible for the protection of personal data: it receives, handles, and answers the consultas and reclamos of data subjects through hola@xpansive.co, within the terms described in this policy.

International transfers

The data collected through the site is hosted on cloud infrastructure and processed by an AI provider that may operate in the United States. These transfers are covered by contractual data-protection commitments with each provider that guarantee a standard of protection consistent with Colombian law, and, where required, by the titular’s authorization, granted when submitting the forms — which disclose this processing before submission.

Effective date and database term

This policy is effective as of July 22, 2026, and remains in force until replaced by a new version published on this site.

The databases it governs are kept for as long as the purposes described here exist: lead data up to two (2) years from the last contact, and application data up to twenty-four (24) months after the selection process ends, without prejudice to earlier deletion at the titular’s request or to longer retention where a legal duty requires it.