Personal data processing policy
Data controller
Co·Tabi is a private consulting brand operated in Colombia by an individual. Data controller: Oscar Fabián Pérez Carrascal, an individual operating under the Co·Tabi trade name. Domicile: Bogotá D. C., Colombia. Contact for privacy requests: info@co-tabi.com.
Scope
This policy covers website visitors, prospective and current clients, business representatives, suppliers, and individuals whose information is lawfully provided in connection with immigration and consulting services.
Personal information
Depending on the engagement, we may process names, contact details, nationality, IDs, passports, visas, immigration records, employment and company information, financial support records, family relationship documents, photographs, correspondence and supporting documentation. Forms and contact channels may also collect submitted responses and necessary technical metadata.
Sensitive data and children
Certain records may reveal sensitive personal data. Providing such data is generally optional except as legally permitted; we will explain its purpose and obtain explicit authorization when required. Children's information will be processed with due regard to their rights, best interests and appropriate representative authorization.
Purposes
We use information to answer inquiries, assess requirements, prepare proposals and contracts, manage internal records and case files, review documents, coordinate translations, prepare and follow up on applications, communicate with authorities, manage billing and comply with legal duties. Optional marketing requires the appropriate authorization and opt-out options.
Authorities and service-related recipients
When necessary for an authorized service, we may disclose relevant information to Colombia's Ministry of Foreign Affairs, Migración Colombia, and other competent consular, administrative, notarial, tax or judicial authorities, as well as translators, allied professionals, employers and service providers involved in the engagement. We do not sell client databases.
Internal systems and processors
Client information may be stored in forms, email, spreadsheets, document repositories and cloud-based workflow systems. Access is limited to authorized persons with a legitimate need. Third-party hosting does not remove our data protection obligations.
International data flows
International services and cloud providers may involve processing outside Colombia. We will distinguish transfers to independent controllers from processing by service providers and apply the authorizations, contractual safeguards and other legal mechanisms required for each operation. This policy alone is not blanket authorization for transfers to any country.
Consent
Where required, we will obtain prior, express and informed authorization, retaining appropriate evidence, unless a legal exception applies. Posting this policy does not replace a form consent notice or specific authorization for sensitive data.
Your rights
You may request access, correction, updates, information on processing and proof of authorization; request deletion or withdrawal of consent when legally applicable; and lodge a complaint with Colombia's Superintendence of Industry and Commerce.
Requests and response times
Contact info@co-tabi.com with identification and details of your request. Access inquiries are generally answered within 10 business days, extendable by 5 with prior notice. Complaints are generally answered within 15 business days, extendable by 8 with prior notice, under Colombian law.
Retention
We retain information as needed for the stated purposes and applicable legal, contractual and evidentiary requirements, then delete or anonymize it where appropriate. Deletion requests may be limited by legal obligations.
Security
We apply risk-appropriate administrative and technical safeguards, including access controls, permissions and confidentiality measures. No system can guarantee absolute security.
Website technologies
Technical functions may be used to operate the website. If analytics, advertising or nonessential tracking technologies are enabled, we will provide additional information and consent options where required. Their presence is not asserted unless actually verified.
Changes
Material changes will be communicated as appropriate, and new consent obtained where required. Effective date: October 20, 2026. This policy may be updated to reflect changes in our actual processing activities and applicable law.
Analytics, advertising measurement and cookies
With your consent, we use Google Analytics 4 to measure visits, pages viewed and general website interactions, and Google Ads to measure clicks on WhatsApp and email links. These events do not confirm completed conversations or purchases. Google may process technical and browsing data under its terms and policies. You can reject optional measurement or change your choice through “Cookie settings”. Contact links remain available without consent.