Privacy Policy

1. Introduction

Zipa ("we," "us," or "our") is a governance and board advisory practice based in Bogotá, Colombia. We take the privacy of the people and organizations we work with seriously — not because we are required to, but because discretion is fundamental to what we do.

This Privacy Policy describes how we collect, use, and protect personal information in connection with our website and advisory services. It applies to visitors to our website and to individuals who contact us or engage our services. For questions about this policy, please contact us at [email protected].

2. Information We Collect

We collect personal information in the following ways:

• Contact form submissions: name, email address, and optionally phone number and message content.
• Direct communications: information shared in emails, calls, or meetings related to an inquiry or engagement.
• Cookies and analytics: basic usage data collected automatically when you visit our website. See Section 5 for details.

We collect only the information necessary to respond to your inquiry or to deliver advisory services. We do not collect sensitive personal data (financial records, health information, etc.) through our website.

Legal Basis for Processing

We process personal information on the following legal bases under Colombian data protection law (Ley 1581 de 2012) and applicable principles:

• Your explicit consent (for contact form submissions)
• Our legitimate interest in responding to inquiries and delivering contracted services
• Compliance with legal obligations

Data Retention

Contact form submissions and inquiry-related communications are retained for up to two years. Engagement-related records are retained for five years following the close of the engagement, in accordance with Colombian commercial and civil recordkeeping requirements. Cookie data is retained in accordance with the durations described in our Cookie Policy.

3. How We Use Your Information

We use personal information for the following purposes:

• To respond to inquiries submitted through our contact form or by email
• To deliver advisory services where an engagement has been agreed
• To send occasional service-related communications (e.g., written summaries, scheduling)
• To analyze how our website is used and improve its content and structure
• To comply with legal obligations

We do not use your personal information for unsolicited marketing. We will only contact you in ways directly related to your inquiry or engagement. If at any point you would prefer not to be contacted, you can let us know and we will respect that.

Sharing with Third Parties

We do not sell, rent, or trade personal information. We may share information with third-party service providers who assist us in operating our website (such as hosting or analytics providers), subject to appropriate data processing agreements. We do not share client information from advisory engagements with any third party under any circumstances.

4. Data Protection Measures

We take reasonable technical and organizational measures to protect personal information against unauthorized access, loss, or disclosure. These measures include:

• Encrypted transmission (HTTPS) for all website communications
• Access controls limiting personal data access to those who need it
• Regular review of data handling practices
• Confidentiality commitments with any third-party service providers

In the event of a data breach that poses a risk to your rights or interests, we will notify you and, where applicable, the relevant supervisory authority within the timeframes required by Colombian law.

5. Cookies

Our website uses cookies to understand how visitors use the site and to remember preferences. We use the following categories of cookies:

• Essential cookies: required for the site to function. These cannot be disabled.
• Analytics cookies: help us understand how visitors navigate the site. Optional.
• Preference cookies: remember settings you have selected. Optional.

You can manage your cookie preferences at any time through our Cookie Policy page.

6. Your Rights

Under Colombian data protection law (Ley 1581 de 2012) and Decreto 1377 de 2013, you have the following rights in relation to your personal data:

• Right to access: you may request a copy of the personal information we hold about you.
• Right to rectification: you may ask us to correct inaccurate or incomplete information.
• Right to erasure: you may ask us to delete your personal data, subject to our legal obligations.
• Right to object: you may object to processing based on our legitimate interests.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time.
• Right to lodge a complaint: you may contact the Superintendencia de Industria y Comercio (SIC), Colombia's data protection authority, if you believe your rights have been infringed.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframes required by law.

7. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

8. Children's Privacy

Our services are directed at organizations and individuals in a professional capacity. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently collected such information, please contact us at [email protected] and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after a policy update constitutes acceptance of the revised terms.

10. Contact Us

For any questions, requests, or concerns related to this Privacy Policy or the handling of your personal data, please reach out to us: