Personal data processing

VENOMTECH S.A.S., a Colombian company with NIT 901.991.367-7, operator of Notificado.

• Email: admin@notificado.co
• Phone: +57 333 227 3151
• Website: https://www.notificado.co

We are the controller of our users' data. For the data of notification recipients we act as processor on behalf of the lawyer or firm, who is the controller. That relationship is governed by the transmission contract included in the terms of service, in its sections on the data we process on the customer's behalf.

• Creating and managing accounts and verifying lawyer status.
• Sending electronic notifications and recording their evidence.
• Keeping the evidence for later verification.
• Invoicing and meeting accounting, tax and legal obligations.
• Handling data subjects' queries, complaints and requests.
• Running the affiliate program for those who take part in it: verifying their identity, computing and paying commissions, withholding tax and issuing the support document.

To access, update and correct their data; request proof of the authorisation; be informed about how their data is used; file complaints with the Superintendencia de Industria y Comercio; revoke the authorisation and request deletion where there is no legal or contractual duty to keep the data; and access their data free of charge.

Queries, complaints and requests are handled by VENOMTECH S.A.S.'s Personal Data Protection Area, under its legal representative. You can file them through the form at notificado.co/habeas-data or by email to privacidad@notificado.co.

• Queries: answered within 10 business days of receipt. If that is not possible, we will tell you why before the term ends, and the answer will follow within 5 more business days at most.
• Complaints: answered within 15 business days counted from the day after receipt. If that is not possible, we will tell you why before the term ends, and the answer will follow within 8 more business days at most. If a complaint is incomplete, we will ask you to complete it within 5 days of receipt.
• Data of notification recipients: if your request concerns data we process on behalf of a lawyer, we forward it to that lawyer, who is the controller, within 2 business days, and we tell you so.

The providers that host or process data on our behalf do so as processors and under our instructions: this is a transmission of data, not a transfer (Decreto 1377 de 2013, arts. 24 and 25). Outside Colombia, the data is hosted in the United States and Germany, countries that are on the Superintendencia de Industria y Comercio's list of countries with an adequate level of protection.

• Amazon Web Services, Inc. (United States, Virginia): sending the notifications and receiving their delivery events; immutable storage of the evidence and of uploaded files.
• ActiveCampaign, LLC, the Postmark service (United States): delivering transactional email and the notifications, and receiving their delivery events. It receives each recipient's email address and the content of each message.
• OVH US LLC, OVHcloud (United States, Virginia; the account mail server, in Oregon): application and database servers, error monitoring and account mail.
• Cloudflare, Inc. (a United States company): R2 storage for database backups (14 days at most) and technical logs (30 days at most). The physical location of that storage is assigned by Cloudflare within its own network.
• Intuition Machines, Inc., the hCaptcha service (United States): anti-bot verification on the sign-in, registration, constancia verification and personal data request pages. It receives the IP address and browser and device signals of whoever uses those pages.
• Google LLC (United States and other countries): sign-in with Google, only if you choose it, in which Google confirms your name and email to us; and public site analytics, only if you accept them in the cookie notice. For sign-in with Google, Google also processes that data under its own policy, as the provider of your Google account.
• ePayco, payment gateway (Colombia): collecting payment for packs and plans, and paying affiliates their commissions. It receives the payer's email and the payment method details entered on its page; to pay an affiliate, their name, ID document, and bank and account number.
• Siigo S.A.S. (Colombia): issuing the electronic invoices and credit notes before the DIAN. It receives each payment's billing details.
• FreeTSA (Germany) and DigiCert, Inc. (United States): timestamps. They receive only the content's SHA-256 fingerprint, never the content or readable personal data.

Before adding a provider that processes personal data, or changing its country, we will give at least 15 calendar days' notice and update this list.

We apply the measures described in the privacy policy and the evidence method. Notification evidence is kept for at least 10 years from when it is created, in immutable storage, and it is not deleted during that term because it must be kept to meet legal and contractual obligations, among them proving the notification in the proceeding (Decreto 1377 de 2013, art. 11). Other data is kept while it is needed for the purposes of this policy and for the periods the law requires. A file sent by download link is kept for 10 years from the send and then deleted, after notice to the firm; its SHA-256 fingerprint remains in the notification's evidence.

This policy applies from the effective date shown at the top of this page. Each version has a number and a date, material changes will be communicated to data subjects, and earlier versions stay published from 2026-09-v3 on. The databases are kept while we provide the service and, afterwards, for the retention periods of this policy.