Privacy and Personal Data Processing Policy

Last updated: September 10, 2026

This English version is a translation of the Spanish policy. The Spanish source text is also available.

This policy governs the processing of personal information provided by visitors and clients through the professional website of Carlos Eduardo Gómez Silva (the “Controller”), in accordance with the applicable Colombian personal data protection framework.

1. Data Controller

Corporate lawyer: Carlos Eduardo Gómez Silva
Contact email and privacy channel: carlosegsclientes@gmail.com.

2. Information We Collect

Through website forms and the channels selected by the data subject, we may collect and store information voluntarily provided, including:

• Names, surnames or company name.
• Email address, phone number and preferred contact channel.
• General information about the matter, location, relevant date or time, availability of documents, intention to engage services and willingness to discuss fees.
• Visit source and campaign parameters, where present.
• Date, version and scope of the authorization granted.
• Service reviews, scores for clarity, efficiency and professionalism, comments, verification identity and optional publication authorization.

The initial business assessment does not request files. Do not include passwords, restricted financial data, trade secrets, counterparties’ names or document transcripts. If additional information is needed later, the appropriate channel and purpose will be explained.

The health-law guidance form may collect general categories of access barriers, medical orders, perceived urgency and prior steps. This can reveal sensitive health information. Providing it is optional and requires separate, explicit authorization. The form does not ask for diagnoses, medical records, files or a patient’s name when another person requests contact on their behalf.

3. Purposes of Processing

Initial contact does not itself establish an attorney-client relationship. Information is handled with confidentiality controls and only for the stated purposes:

• Receive, organize and initially review a request.
• Contact the data subject through the selected channel and coordinate a possible consultation.
• Check availability, practice area and potential conflicts before accepting a matter.
• Provide guides requested by the data subject.
• Send editorial communications when the data subject has authorized a subscription.
• Verify, analyze and respond to service reviews; publish only those with specific authorization and a prior confidentiality review.

Authorization to respond to a request does not by itself authorize advertising or newsletter subscription. Submitting a review does not automatically authorize publication. Publication authorization is optional and may be withdrawn; it does not affect current or future services. The Controller may decline to publish content that reveals a matter, third parties or confidential information.

4. Analytics, Visit Source and Navigation Events

After the visitor accepts analytics, the site uses tools to produce aggregated statistics on pages viewed, general traffic sources, article readership and contact-button use. Links on professional networks may contain campaign parameters, for example to identify visits from LinkedIn. Names, email addresses, identity documents and the content of inquiries are not sent to the analytics tool.

Contact events record only operational information such as a general category, completed step and selected channel. Names, email addresses, phone numbers and free-text narratives are not sent to analytics.

5. Providers, Security and Storage

Forms are processed through Netlify Forms. The site may send an internal operational notice through Telegram. For business, health and review forms, that notice excludes names, contact details and free text. Health notices are further limited to operational urgency and location indicators; review notices contain scores and authorization status, which must be checked in the authorized dashboard. Google Analytics is activated only after the visitor’s analytics choice. If a visitor voluntarily continues to Google, WhatsApp, Telegram or email, those services’ terms and controls also apply.

The business integration with HubSpot may synchronize name, email, phone, company, campaign source, authorization version and operational contact classification. It does not send the business form’s free-text narrative or health-form information to HubSpot. Access controls are applied, and a requested response is kept separate from any optional authorization for further communications.

When someone voluntarily opens HubSpot’s scheduling page, HubSpot processes the minimum identity and email information needed to manage the booking, check availability, create the event and send confirmations or reminders. The invitation uses a general title and should not be used to communicate matter details or attach confidential documents. Cancellation and rescheduling links are included in the confirmation.

Reasonable data-minimization, access-control and transmission-security measures are applied. No internet-connected system can promise absolute security or confidentiality, so the first form must not be used to send particularly sensitive documents or information.

6. Retention

Information is kept for as long as needed to review and respond to the request, manage any professional relationship, meet applicable obligations or resolve claims. When no longer necessary, it will be deleted or anonymized according to the procedures and capabilities of the providers used. The data subject may request deletion unless a legal or contractual duty requires retention.

7. Data Subject Rights

As a data subject or authorized representative, you may:

• Access, update and correct outdated, incomplete or inaccurate information.
• Request proof of authorization and learn how your data have been used.
• Withdraw authorization or request deletion where applicable.
• Submit an inquiry or complaint to carlosegsclientes@gmail.com.

8. Authorization and Effective Date

Where law requires authorization, it must be prior, express, informed and available for later consultation. This policy takes effect on publication and may be updated when purposes, forms or providers change. Material changes will be communicated through an appropriate channel and, where required, a new authorization will be requested.