Privacy Policy
Last Updated: September 14, 2026
1. Introduction
Welcome to www.colombianpassport.com (the "Website", "we", "us", "our"). This Privacy Policy explains clearly how we collect, use, share and protect your personal information. We comply with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the UK GDPR where applicable, and Colombia's Law 1581 of 2012 (Habeas Data) for data subjects in Colombia — a large part of our clients.
Key terms (GDPR): Personal Data (any information relating to an identifiable person: name, email, phone, IP, documents); Processing (any operation on data); Data Controller (who decides purposes/means: us); Data Processor (who processes on our behalf); Data Subject (you).
2. Data Controller
The controller is Alejandro Moreno Azcárate, sole trader (autónomo) registered in Spain — NIF 60050553z, business address Calle Vilar de Donas 15 Escalera G Puerta 1B, Madrid. Contact for privacy matters: amoreno@colombianpassport.com.
3. Information We Collect
Data you provide directly: contact information (name, email, phone); communication content (forms, email, WhatsApp messages); immigration case documents — as a visa law firm we necessarily process passports, birth/marriage certificates, background checks, financial and employment records you provide for your case; comments/contributions on the Website.
Sensitive/high-risk data: unlike generic websites, our service requires identity and civil-status documents. We process them solely for your immigration case (contractual necessity), never for marketing or unrelated purposes, with heightened safeguards (Section 9). If a case involves minors (e.g., beneficiary visas), we require parental/guardian consent.
Data collected automatically: IP address, browser/OS/device type, pages visited, timestamps, referrers, cookie identifiers (see Section 5).
Data from third parties: aggregated ad-performance data, social-media interactions, and Google analytics/ads data.
4. Purposes and Legal Bases (Art. 6 GDPR)
4.1. Inquiries and requested services. We process your contact information and message content to respond to your questions and provide the information or services you request. Legal basis: contract (Art. 6(1)(b)) for pre-contractual requests, or our legitimate interest in managing communications (Art. 6(1)(f)). Retention: 1 year after the last interaction.
4.2. Immigration case management (SOFI platform). We process your case documents and contact details to handle your file, prepare SITAC filings, follow up on requirements and track your process. Legal basis: performance of our services contract (Art. 6(1)(b)), and legal obligation (Art. 6(1)(c)) where migration regulations require it. Retention: duration of the case plus 5 years (Spanish legal limitation periods).
4.3. WhatsApp communications (SOFI line +57 322 226 3737 and human line +57 322 339 5612). We process your phone number, message content and attached media to send case status updates, document requests and appointment reminders, and we attach received media to your file. Legal basis: your consent (Art. 6(1)(a)) given via the web checkbox, your initial HOLA message, or the service-contract clause — and contract performance (Art. 6(1)(b)) once you are a client. You may opt out anytime by writing STOP or emailing us; case information will then continue by email and portal. Retention: logs linked to active cases per 4.2; otherwise 1 year.
4.4. Technical operation and security. We process technical data and strictly necessary cookies to run, maintain and secure the Website. Legal basis: legitimate interests (Art. 6(1)(f)). Retention: session data, up to 12 months for security logs.
4.5. Analytics (Google Analytics). We analyze aggregated usage (pages, time on site) to improve content and performance. Legal basis: your consent (Art. 6(1)(a)) via the cookie banner. Retention: 14–26 months per Analytics settings.
4.6. Personalized advertising / remarketing (Google Ads). With your explicit consent (Art. 6(1)(a)) we show relevant ads based on previous visits. Retention per cookie (Section 5).
4.7. Newsletters and marketing emails. Only with your explicit opt-in consent (Art. 6(1)(a)). We keep your address until you unsubscribe (plus an opt-out record). Every message includes an unsubscribe link.
4.8. Legal compliance and defense of rights. Where required by authorities or to defend legal claims, under legal obligation (Art. 6(1)(c)) or legitimate interests (Art. 6(1)(f)). Retention per applicable law.
Colombia (Law 1581/2012). Processing of Colombian residents' data relies on your prior, express and informed authorization (Art. 9), granted via our forms, contract or WhatsApp opt-in. You may consult, update, rectify or delete your data with us and file complaints before the Superintendence of Industry and Commerce (SIC).
5. Cookies
Our Website uses strictly necessary cookies (no consent needed, legitimate interests), preference cookies (consent), analytics cookies — Google Analytics _ga (2 years), _gid (24 hours) — and marketing cookies — e.g., Google Ads IDE (13 months), Wix session cookies. Except for strictly necessary ones, cookies activate only after your prior, explicit consent via our banner, with accept-all / reject-all / granular options, changeable anytime. Manage also via browser settings and Google Ad Settings (adssettings.google.com) / My Ad Center.
6. Withdrawing Consent
Via the cookie tool (cookies), unsubscribe links (email), STOP by WhatsApp (messaging), or email to our privacy contact. Withdrawal is as easy as giving consent and never retroactive.
7. Who We Share Data With
We do not sell personal data. Processors under Art. 28 DPAs: hosting/Wix, email, analytics/ads and payment providers, acting only on our instructions. Meta Platforms Ireland Ltd (WhatsApp Business Platform) processes your WhatsApp number, message content and media to deliver case communications (EU-US Data Privacy Framework + Standard Contractual Clauses, see Section 8). Google (Analytics/Ads, same safeguards). Disclosures to authorities where legally required. Business transfers only with prior notice.
8. International Transfers
GDPR Chapter V: adequacy decisions (including the EU-US Data Privacy Framework — Google and Meta are certified); otherwise the 2021 Standard Contractual Clauses plus a Transfer Impact Assessment. Details available on request.
9. Security
SSL/TLS encryption, encryption at rest for case files, role-based access (only your assigned lawyers), data minimization, periodic audits and DPIAs for high-risk processing, staff training, and 72-hour breach notification (Arts. 33–34 GDPR).
10. Retention
Per each purpose in Section 4. When no longer necessary, data is securely deleted or anonymized.
11. Your Rights (GDPR + Ley 1581)
Information, access, rectification, erasure ("right to be forgotten"), restriction, portability, objection (absolute for marketing), no solely-automated decisions (Art. 22 — our AI assists, lawyers decide), consent withdrawal, and complaint before your EU supervisory authority or the Colombian SIC.
12. How to Exercise Them
Email amoreno@colombianpassport.com. We verify your identity with minimum data, reply within 1 month (+2 for complex cases), free unless manifestly unfounded or excessive. Data-deletion instructions (for Meta): this section plus the same email — requests honored per Art. 17 GDPR.
13. Google Ads Notice
Ads may be personalized only with your consent; otherwise generic/contextual. Google restrictions on sensitive data apply; it does not use Gmail/Drive content for ads. Controls: Google Ad Settings and My Ad Center. We comply with Google's EU User Consent Policy via our CMP.
14. Changes
Material changes will be announced prominently (and by email where appropriate). Continued use after posting constitutes acceptance, subject to renewed consent where required.