PRIVACY FRAMEWORK
Personal Data Processing Policy
ARCA COMERCIALIZADORA INTERNACIONAL S.A.S.
01 DATA CONTROLLER
ARCA COMERCIALIZADORA INTERNACIONAL S.A.S., identified by NIT 901439007-5, domiciled in Maicao, La Guajira, Colombia, at Carrera 15 No. 17-50 Local 5, Barrio San Martín, telephone +57 320 372 6511 and website arcaci.store, acts as the Data Controller for the personal data to which this policy applies.
For inquiries, complaints, and the exercise of personal-data rights, ARCA provides the following email address:
The General Management of ARCA COMERCIALIZADORA INTERNACIONAL S.A.S. is responsible for personal-data protection and for processing Data Subjects’ requests, inquiries, and complaints. The email address datos.personales@arcaci.store is available for exercising these rights.
02 PURPOSE AND SCOPE
This policy establishes the criteria under which ARCA collects, stores, uses, consults, organizes, updates, transmits, deletes, and generally processes personal data obtained in its commercial relationships, particularly through its digital channels.
This policy applies to the personal data of prospects, business contacts, and other individuals who provide information to ARCA in connection with a request, sourcing need, project, business capability, or commercial opportunity.
03 DATA THAT MAY BE PROCESSED
Through the Let’s Talk form, ARCA may process identification and contact data such as name, represented company, job title or role, email address, and telephone number; information about the market, organization type, company website, and commercial opportunity context; as well as limited technical attribution information, such as the originating page or call to action and campaign parameters where available.
ARCA does not request passwords, banking information, identity documents, confidential financial information, or sensitive data through this form. Users are asked not to include such information in free-text fields.
04 PROCESSING PURPOSES
Personal data collected through Let’s Talk will be processed to receive and record commercial requests or opportunities; validate and understand the context provided; classify the opportunity internally; assess its possible fit with ARCA’s capabilities and services; conduct commercial follow-up; contact the Data Subject using the provided email address or telephone number regarding the opportunity; assign internal owners and next actions; maintain process traceability; handle inquiries or complaints; preserve evidence of authorization; protect system security and integrity; and prepare internal metrics on the origin and performance of commercial channels.
When information is no longer necessary to identify the Data Subject, ARCA may retain properly anonymized information for statistical and commercial-intelligence purposes.
Authorization given through the form alone does not constitute authorization for mass promotional campaigns or marketing communications unrelated to the submitted request or opportunity.
05 AUTHORIZATION
Except where the law provides otherwise, ARCA will request the Data Subject’s prior and informed authorization before processing personal data.
In electronic forms, authorization must be given through an express affirmative action. ARCA will retain evidence showing, as applicable, the consent version, stated purpose, form version, and date and time of authorization.
06 PROCESSORS AND SERVICE PROVIDERS
ARCA may use technology providers for necessary web hosting, infrastructure, email, security, backup, and systems operations services.
ARCA’s website uses WordPress as its technology platform and infrastructure services contracted by ARCA, currently including Hostinger. When a third party processes personal data on ARCA’s behalf, it must do so under the instructions and terms applicable to the contracted service and in accordance with the relevant data-protection obligations.
07 PROCESSING OUTSIDE COLOMBIA
Depending on the technology infrastructure used, some providers or sub-processors may process data outside Colombia.
When an international transmission or transfer of personal data applies, ARCA will adopt the corresponding contractual, organizational, and legal measures under applicable law.
08 DATA SUBJECT RIGHTS
Data Subjects may know and access their personal data; request updates or corrections when data are partial, inaccurate, incomplete, or misleading; request proof of authorization where applicable; know how their data have been used; submit inquiries or complaints; request deletion of data or withdrawal of authorization where appropriate; and file complaints with the Superintendence of Industry and Commerce after completing the corresponding process with ARCA, under the terms provided by law.
09 INQUIRY AND COMPLAINT PROCEDURE
Requests related to personal data must be sent to:
The request must reasonably identify the Data Subject and describe the inquiry, update, correction, deletion, withdrawal, or complaint being submitted.
ARCA may request only the information reasonably necessary to verify the Data Subject’s identity or the authority of a representative, initially seeking to use data associated with the existing relationship or request.
Inquiries will be addressed within a maximum of ten (10) business days after receipt. When this is not possible, ARCA will state the reason for the delay and provide a new response date, which may not exceed the following five (5) business days after the initial deadline.
Complaints will be addressed within a maximum of fifteen (15) business days counted from the day after receipt. When this is not possible, the reason and a new response date will be provided; that date may not exceed the following eight (8) business days after the first deadline.
When a complaint is incomplete, the interested party may be asked to complete the information under the applicable legal terms. The interested party may correct the deficiency within five (5) days after receiving the request. If two (2) months pass from the request for correction without the required information being provided, the complaint will be deemed withdrawn.
If ARCA receives a complaint for which it is not competent, it will forward it to the competent person or area within a maximum of two (2) business days and inform the interested party. Once a complete complaint is received, ARCA will internally identify the relevant record as “complaint in progress” and state the reason for the complaint within no more than two (2) business days, maintaining that status until resolution.
10 SECURITY
ARCA will adopt reasonable and proportionate technical, administrative, and organizational measures to protect personal information against loss, misuse, unauthorized access, alteration, or improper disclosure.
Access to commercial records must be limited to authorized users and technology providers that need to process the information to perform their assigned functions.
No information system can be considered completely immune to risks, so ARCA will assess and adjust its measures as its infrastructure and risk level evolve.
11 RETENTION AND DELETION
Data associated with prospects and commercial opportunities will be retained while an active opportunity exists.
The databases covered by this Policy will remain in force while the purposes justifying processing continue and for the additional time needed to meet legal or contractual obligations or defend rights. For records associated with prospects and commercial opportunities, the retention rule is the period established in this Policy of up to thirty-six (36) months from the last significant commercial interaction, unless a different period applies by legal obligation or deletion is appropriate.
When there is no active commercial relationship, ARCA may retain such data for up to thirty-six (36) months from the last significant commercial interaction, unless a legal or contractual obligation or another valid justification requires a different period.
A prospect response, call or conversation, meeting, new request, quotation request, additional information, or express reactivation of the opportunity may be considered a significant commercial interaction.
An automated communication from ARCA, by itself, will not restart the retention period.
Once the period has elapsed and the purpose justifying processing has ended, the data will be deleted or anonymized as appropriate, without prejudice to the minimum retention that may be necessary to evidence legal obligations or compliance with data-protection rules.
12 WHATSAPP AND CONTINUITY CHANNELS
When, after successfully submitting the form, the Data Subject voluntarily chooses to continue through WhatsApp, that action will be considered the Data Subject’s own initiative to continue the conversation about the previously submitted opportunity through that channel.
ARCA will seek not to include additional personal data in links used to start that conversation. The opportunity reference may be used to relate the WhatsApp conversation to the existing commercial record.
13 POLICY UPDATES
ARCA may update this policy as a result of legal, regulatory, technological, operational, or processing changes.
Material changes affecting processing purposes or conditions must be communicated in a timely manner before implementation when required by applicable law.
The current version will be available at:
arcaci.store/politica-de-tratamiento-de-datos/
14 EFFECTIVE DATE
This Personal Data Processing Policy becomes effective on the date it is published on ARCA’s website.
Version:
ARCA-PTDP-WEB-2026-01
Retention of personal databases and records will be subject to the purposes, periods, and criteria defined in this policy and to applicable legal or contractual obligations.