ES Let’s talk

Privacy Policy

Last updated: [date pending approval]

Draft pending legal review for Colombia, Ecuador, Bolivia and the United States.

1. Who is responsible for your data

The controller of the personal data collected on roisense.com, in its chat and in its contact form is ROISense, through the company of the country where you are. This policy covers only this site; when we process data on behalf of our clients under a contract, that contract and the client’s own policy apply.

  • Colombia: [TO CONFIRM: legal name, NIT, registered address, phone].
  • Ecuador: RUC 1792624363001; [TO CONFIRM: legal name, registered address, phone].
  • Bolivia: [TO CONFIRM: legal name, NIT, registered address, phone].
  • United States: [TO CONFIRM: legal name, state of incorporation, EIN, address].
  • Privacy contact for all of them: [TO CONFIRM: privacy email]. Area in charge of handling requests: [TO CONFIRM: area or position]. The addresses of our offices are also listed on the Studio page.

2. Data we collect

Only what you give us and, if you accept it, what your browsing tells us. We do not ask for sensitive data (health, biometrics, beliefs, political opinions and the like) and we ask you not to include it in the chat.

  • What you write in the MADE and Talk to us chat: name, work email, company, country, WhatsApp and what you ask or tell us.
  • If the chat is not available, the contact form: name, work email, company and the problem you tell us about.
  • Technical data needed to serve the site: IP address, browser, device and the pages requested, recorded by our hosting provider to deliver the site and protect it from abuse. In the contact form, Cloudflare Turnstile checks browser signals to tell people from bots.
  • Only if you accept analytics or advertising: pages visited, approximate location (country or city), device, browser, the buttons you use and, with advertising, the ad you came from. Before sending the page address to Google Analytics, we remove any parameter that is not a campaign parameter.

3. What we use it for

We do not sell your data for money and we do not use it for purposes other than these:

  • Answering your request and following up on a possible commercial relationship (including sending you the proposal or information you ask for).
  • Understanding which content is useful and improving the site (only with analytics).
  • Measuring our campaigns and showing our ads again to people who visited us (only with advertising).
  • Keeping the site and the form secure and preventing spam and fraud.
  • Complying with our legal obligations and defending ourselves in claims.

4. Legal basis and authorization

We process your data with your prior, express and informed authorization, which you give by turning on each category in the cookie banner and by sending your data in the chat or the form after seeing this policy; with the pre-contractual measures you request when you contact us; and, for site security and legal obligations, on our legitimate interest and the law. Your cookie choice is stored in your browser with its date, and the chat and form keep a record of the data you sent. You can withdraw your authorization at any time, without affecting what was done before.

5. Cookies, analytics and advertising

Google Tag Manager loads only if you accept analytics or advertising; until then no measurement script is downloaded, no cookie is created and no data is sent. Each category is turned on separately and Google receives each signal separately (Consent Mode). With analytics we use Google Analytics 4; with advertising, Google Ads, the Meta pixel and the TikTok pixel measure our campaigns and allow remarketing. You can see how Google uses this data at policies.google.com/technologies/partner-sites. The list of cookies, with their duration, is in the Cookie Policy.

6. MADE, the chat and artificial intelligence

MADE and Talk to us run on ioZen, which processes the conversation and the data you leave in it on our behalf; inside the chat, ioZen uses Microsoft Clarity to measure how it is used. The chat only loads if you accept it, and you can withdraw that from Cookie settings. MADE is an AI agent: its answers are informative and are not a commercial offer. We do not make decisions with legal or similarly significant effects about you based solely on automated processing; a person on our team reviews every contact.

7. Who processes data for us

We share data only with these providers and only for what is described. Those marked as processors act on our instructions under a contract; the advertising platforms also use the data for their own purposes, as independent controllers under their own privacy policies.

  • Vercel Inc. (United States): site hosting and technical records. Processor.
  • Google LLC (United States): Tag Manager and Analytics (processor, only with analytics) and Google Ads (independent controller, only with advertising).
  • Meta Platforms (United States and Ireland): Meta pixel, only with advertising. Independent controller. If you write to us on WhatsApp, Meta processes that conversation under its own terms.
  • TikTok (TikTok Pte. Ltd., TikTok Inc. or the entity for your region): TikTok pixel, only with advertising. Independent controller.
  • ioZen: chat and record of contacts. Processor. [TO CONFIRM: ioZen legal entity and country].
  • Microsoft Corporation (United States): Clarity, inside the chat. Processor.
  • Cloudflare, Inc. (United States): Turnstile anti-spam check, only in the contact form. Processor.
  • Resend (Plus Five Five, Inc., United States): sending the contact form to us by email. Processor.
  • Authorities, when a law or a court order requires it.

8. International transfers

Several of these providers process data outside your country, mainly in the United States. We only transfer data to countries with an adequate level of protection recognized by the competent authority or with appropriate safeguards (data processing agreements and standard contractual clauses), or with your consent where the law requires it. By using the chat, the form or turning on analytics or advertising, you are informed that your data will be processed in the United States.

9. How long we keep it

We keep your data only while it serves the purpose for which we collected it, and then we delete or anonymize it, unless a law requires us to keep it longer.

  • Chat conversations and contact details: while the commercial relationship lasts and up to [TO CONFIRM: 2 years] after the last contact, unless you ask us to delete them earlier.
  • Analytics: 14 months in Google Analytics.
  • Advertising: according to the settings of each platform, up to [TO CONFIRM: 180 days] for audiences.
  • Hosting technical records: the time Vercel keeps them under its service, [TO CONFIRM: retention of logs on our plan].
  • Your cookie choice: in your browser until you change it or delete it.

10. Security

The site is served only over an encrypted connection (HTTPS), access to contacts is limited to the people on our team who need it, and our providers commit by contract to protect the data. No system is infallible: if a security incident affects your data, we will notify you and the competent authority as the law requires.

11. Your rights

Depending on the law that applies to you, you can:

  • Know what data we have about you and how we use it (access).
  • Update and correct it (rectification).
  • Ask us to delete it when it is no longer needed or when you withdraw your authorization (erasure).
  • Object to its processing or ask us to suspend or restrict it.
  • Receive it in a structured, commonly used format or have it sent to another controller (portability).
  • Not be subject to decisions based solely on automated processing.
  • Withdraw your authorization or consent at any time.
  • Opt out of the use of your data for targeted advertising (see the United States section).
  • Ask for proof of the authorization you gave us, and complain to the data protection authority.

12. How to exercise them

Write to [TO CONFIRM: privacy email] with your name, the email or phone you used with us, what you are asking for and, if we need to verify your identity, a copy of an identity document; a representative may do it with proof of representation. It is free. We answer within the deadlines of the law that applies to you (see the next sections); if we need more time or more information, we will tell you why within the original deadline. To withdraw your consent to cookies or the chat, you do not need to write: use Cookie settings in the footer.

13. If you are in Colombia

This policy is our data processing policy under Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015). As the data subject you have the right to know, update, rectify and delete your data, to request proof of the authorization, to be informed of how we use it, to revoke the authorization and to complain to the Superintendence of Industry and Commerce (SIC).

  • Inquiries (what data we have and how we use it): we answer within 10 business days from receipt, extendable once by up to 5 business days, telling you the reason.
  • Claims (correction, update, deletion, revocation or breach of the law): we answer within 15 business days from the day after receipt, extendable once by up to 8 business days. If the claim is incomplete, we will ask you to complete it within 5 days; if you do not do so within 2 months, we will consider it withdrawn.
  • Before going to the SIC you must have filed the inquiry or claim with us (Article 16 of Law 1581). SIC: www.sic.gov.co.
  • Revocation and deletion do not apply while you have a legal or contractual duty to remain in the database.
  • National Register of Databases: [TO CONFIRM: whether ROISense must register its databases with the SIC (mandatory for companies with total assets above 100,000 UVT) and, if so, its registration].

14. If you are in Ecuador

The Organic Law on Personal Data Protection (LOPDP, 2021) and its General Regulation apply. Our legal bases are your consent, the pre-contractual measures you request and our legitimate interest in the security of the site. You have the rights to information, access, rectification and updating, erasure, objection, portability, suspension of processing and not to be subject to a decision based solely or partly on automated assessments.

  • We answer access, rectification, erasure, objection and portability requests within 15 days.
  • If we do not answer or you disagree, you can complain to the Superintendence of Personal Data Protection (www.spdp.gob.ec).
  • Data protection officer: [TO CONFIRM: whether ROISense must appoint one under Article 48 of the LOPDP and, if so, name and contact].

15. If you are in Bolivia

Bolivia does not yet have a general personal data protection law. We apply this policy in full and respect your rights to privacy and to know, rectify and delete your data recognized by the Political Constitution of the State (Articles 21 and 130), which you can also enforce through the privacy protection action.

16. If you are in the United States

Comprehensive state privacy laws, such as the California Consumer Privacy Act as amended by the CPRA and similar laws in Colorado, Connecticut, Virginia, Texas, Oregon and other states, apply to companies that exceed certain thresholds (in California, for example, annual gross revenue above about USD 26.6 million, adjusted for inflation, or personal information of 100,000 or more consumers or households). [TO CONFIRM: whether ROISense exceeds any of them.] Either way, this is how we handle it:

  • Categories we collect: identifiers and contact details, professional information, internet activity on this site and approximate location; sources and purposes as described above. We do not collect sensitive personal information.
  • We do not sell personal information for money. The advertising pixels (Google Ads, Meta, TikTok) may count as "selling" or "sharing" for cross-context behavioral advertising or "targeted advertising". That is why they are off unless you turn on Advertising, and turning it off in Cookie settings works as your request to opt out of the sale or sharing of your personal information.
  • Global Privacy Control: if your browser sends this signal, we treat it as a refusal of Advertising. [TO CONFIRM: pending implementation in the banner.]
  • Your rights, where the law applies: to know and access, correct, delete, obtain a portable copy, opt out of sale, sharing, targeted advertising and profiling, and not to be discriminated against for exercising them. You may use an authorized agent. We answer within 45 days, extendable by 45 more when reasonably necessary, and if we deny your request you can appeal by writing to the same address.
  • We do not knowingly sell or share data of people under 16.

17. If you are in the European Union

If you visit us from the European Economic Area, the General Data Protection Regulation (GDPR) applies. Legal bases: consent for analytics, advertising and the chat (Art. 6(1)(a)); the pre-contractual measures you request (Art. 6(1)(b)); and our legitimate interest in the security of the site (Art. 6(1)(f)). You have the rights of access, rectification, erasure, restriction, objection, portability and to withdraw consent; we answer within one month, and you can complain to the supervisory authority of your country. Transfers to the United States rely on the EU-US Data Privacy Framework where the provider is certified, or on standard contractual clauses. [TO CONFIRM: whether an EU representative is needed under Article 27 of the GDPR.]

18. Children

This site is for companies and professionals. It is not directed at children under 13 (or under the minimum age of your country) and we do not knowingly collect their data, in line with the United States Children’s Online Privacy Protection Act (COPPA). If you believe a minor has sent us data, write to us and we will delete it.

19. Effective date and changes

This policy takes effect on [TO CONFIRM: effective date] and our databases remain in force for as long as the purposes described here last. If we change it substantially, we will publish the new version here with its date and, if the change affects the purposes for which you gave us your authorization, we will ask you for it again.