Personal Data Processing Policy
Courtesy translation. This policy is issued under Colombian law; in case of any discrepancy, the Spanish version prevails.
| Legal name | SANNA Solutions S.A.S. |
|---|---|
| Tax ID (NIT) | 902068158-1 |
| Address | Bogotá, Colombia |
| Contact email | anamaria@sannasolutions.com |
| Alternate email | santiago@sannasolutions.com |
| Website | sannasolutions.com |
1. Identification of the Data Controller
In compliance with Law 1581 of 2012 and Decree 1074 of 2015, SANNA Solutions S.A.S. acts as Data Controller for the personal data collected through its website sannasolutions.com and its commercial contact channels.
2. Legal framework
- Law 1581 of 2012 — General personal data protection regime in Colombia.
- Decree 1074 of 2015 — Which compiles Decree 1377 of 2013, regulating Law 1581 of 2012.
- Circulars of the Superintendence of Industry and Commerce (SIC) on data protection.
3. Personal data collected
SANNA Solutions collects only the personal data that the data subject voluntarily provides through the website contact form or direct commercial channels (email, WhatsApp, diagnostic meetings):
| Personal data | Type |
|---|---|
| Full name | Identification |
| Email address | Contact |
| Phone number | Contact |
| Company name | Business context |
SANNA Solutions does not collect sensitive data (Art. 5, Law 1581/2012) through these channels.
4. Purposes of processing
The purposes described below apply to all Data Subjects who have authorized the Company to process their Personal Data:
- Recording Personal Data in SANNA's systems.
- Transmission and Transfer of Personal Data, with respect for the legal safeguards applicable to each of these operations.
- Sending information to administrative or judicial authorities at their request, guaranteeing respect for the Data Subject's rights in each case.
- Informing about substantial changes to the Policy adopted by SANNA.
- Responding to requests, inquiries, claims and/or complaints submitted by Data Subjects through any of the channels made available by the Controller.
- Sending communications and relevant information arising from the relationship between the Data Subject and the Controller by any physical or digital means, including but not limited to: social networks (Facebook, Instagram, Twitter, WhatsApp, among others), telephone, SMS or email.
- Any other purpose that is necessary as a result of the relationship between the Data Subject and SANNA or of the authorization given by the Data Subject.
a. Clients (including Prospective Clients)
SANNA will process Personal Data of Clients (and prospective clients) in its customer relationship management systems (CRM) and similar systems. The purposes applicable to Clients (or to the Personal Data of Data Subjects acting as contact points for those Clients) will be, in addition to those applicable in other sections where relevant, the following:
- Managing the commercial relationship with clients (such as, but not limited to, sale or lease of real estate) through the processing of Personal Data.
- Carrying out commercial and marketing activities through the processing of Personal Data.
- Sending important information about the relationship with the Company, as well as about the Company's products, campaigns, events, websites or digital initiatives, changes to its terms, conditions and policies, and any other administrative information. For these purposes, SANNA may use any physical or digital means, including but not limited to: social networks (Facebook, Instagram, Twitter, WhatsApp, among others), telephone, SMS or email.
- Following up on and processing reports of quality complaints about SANNA's services and claims.
- Handling and managing information and contact requests sent by the data subject.
- Assessing the viability of a commercial or service relationship between the data subject and SANNA Solutions.
- Sending information about SANNA Solutions' services when the data subject has requested or expressly authorized it.
- Complying with legal obligations and requests from competent authorities.
b. Employees
SANNA will use the Personal Data of its employees and other members of its workforce for the purposes listed below:
- Incorporating the Data Subject's Personal Data into the employment contract, its amendments and additions, and into any other documents needed to manage the employment relationship and the obligations arising from it that fall on SANNA as Data Controller.
- Managing the Data Subject's Personal Data, and that of their immediate family where the Controller is entitled to process it, in order to carry out enrollment procedures with health insurance providers (EPS), family compensation funds, occupational risk insurers (ARL) and others necessary for SANNA to fulfil its duties as an employer.
- Sending internal communications, whether or not related to their employment.
- Responding to employee requests for certificates, statements and other documents requested from SANNA by reason of the employment relationship.
- Incorporating Personal Data into SANNA's active and historical employment files and keeping them up to date; managing the Data Subject's Personal Data to ensure the correct assignment of work tools (including IT tools such as email, computers, mobile devices, database access, etc.).
SANNA Solutions will not use the data for purposes other than those declared here without first obtaining a new authorization from the data subject.
5. Legal basis for processing
In accordance with Article 9 of Law 1581 of 2012, the processing of personal data requires the prior, express and informed authorization of the data subject. By submitting the contact form or providing their data through another direct channel, the data subject consents to the processing described in this Policy, which has been made available to them before that act.
6. SANNA Solutions also acts as Data Processor
In addition to collecting data as Controller through its own channels (sections 1 to 5), SANNA Solutions provides artificial-intelligence automation services to client companies, in the course of which it may process personal data of those clients' end users.
In those cases, SANNA Solutions acts as Data Processor on behalf of each client (the Controller), under a Personal Data Transmission Agreement (DPA) signed with each of them, in accordance with Article 25 of Decree 1377 of 2013. Each SANNA Solutions client is responsible for informing its own data subjects about the processing of their data, including the involvement of SANNA Solutions as a technology provider.
This Policy does not govern those specific client-by-client relationships; each is governed by its own Data Transmission Agreement and by the privacy policy published by the corresponding client.
7. Recipients of the data and international transmissions
Personal data collected through SANNA Solutions' own channels (sections 1 to 5) may be transmitted to the following recipients:
| Recipient | Country / Server | Purpose |
|---|---|---|
| Corporate email provider (Google Workspace) | USA | Managing communications with the data subject |
| Supabase (internal contact management and commercial follow-up) | USA | Recording and following up contact requests |
| Notion (internal contact management and commercial follow-up) | USA | Recording and following up contact requests |
In the event of an international transfer of data (Art. 26, Law 1581/2012), SANNA Solutions will ensure that the recipient countries offer adequate levels of protection or that sufficient contractual safeguards are in place.
8. Retention periods
| Type of data | Maximum period | Action on expiry |
|---|---|---|
| Prospects with no formalized commercial relationship | 12 months from first contact | Deletion or anonymization |
| Prospects with an active commercial relationship | Term of the contract + 2 years | Deletion or anonymization |
Legal record-keeping obligations (tax, accounting or other) prevail over the periods defined here.
9. Data subject rights (ARCO)
- Access: to know what personal data SANNA Solutions holds about them and how it is processed.
- Rectification: to request correction of inaccurate, incomplete or outdated data.
- Cancellation (deletion): to request deletion of their data when the processing is not proportionate to its purpose or when they withdraw their consent.
- Objection: to object to the processing of their data for specific purposes, including commercial communications.
To exercise these rights, the data subject must send a request to anamaria@sannasolutions.com with the subject line “Exercise of ARCO rights”, stating their full name, a contact detail and a description of the right they wish to exercise.
SANNA Solutions will handle the request within the deadlines set by Article 14 of Law 1581 of 2012: ten (10) business days, extendable by five (5) additional business days with a reasoned notice to the data subject.
10. Withdrawal of consent
The data subject may withdraw their consent at any time, in whole or in part, without retroactive effect, by sending a request through the same channel indicated in the previous section. SANNA Solutions will stop the processing within ten (10) business days of receiving the request, unless a legal obligation prevents immediate deletion.
11. Security measures
SANNA Solutions implements technical, administrative and organizational measures to protect personal data against unauthorized access, loss, alteration or improper disclosure, in compliance with the security principle of Article 4(f) of Law 1581 of 2012. In the event of a security incident affecting personal data, SANNA Solutions will notify the affected data subject and the SIC in accordance with applicable regulations.
12. Changes to this Policy
SANNA Solutions may update this Policy when necessary. Any substantial change will be communicated through the website at least ten (10) business days before it takes effect. The current version will always be available at sannasolutions.com.
13. Supervisory authority
Data subjects who believe their rights have been violated may file a complaint with the Superintendence of Industry and Commerce (SIC): website www.sic.gov.co · Bogotá helpline 601 592 0400.
Version history
| Version | Date | Description |
|---|---|---|
| v1.0 — Draft | June 2026 | Initial version. |
| v1.1 — Draft | July 2026 | Section 6 added (SANNA as Processor, general mention without client-level detail). Section 7 completed (Notion as internal CRM, pending confirmation of any other). Section 12 completed (cookies, assuming none active — to be confirmed). |