SUMMA PRIVACY POLICY

Last Updated: May 27, 2025

1. INTRODUCTION AND DATA CONTROLLER

Welcome to Summa (BPO SUMMA). At Summa, we are committed to protecting the privacy and security of the personal data we process. This Privacy Policy explains how we collect, use, store, share, and protect your personal information.

For the purposes of Colombian law (Law 1581 of 2012 and complementary regulations), Summa, located at Cra. 19b #83-63, Bogotá, Colombia, and reachable at contacto@summavalor.com.co, acts as the Data Controller for the personal data it collects directly from its clients, prospects, website users, and employees.

When Summa provides business process outsourcing (BPO) services to its Clients, it acts as a Data Processor for the personal data entrusted to us by those Clients (who act as Data Controllers). In such cases, data processing is governed by the Client’s instructions and specific contractual agreements (Data Processing Agreements).


2. SCOPE OF THIS POLICY

This Policy applies to:

  • Visitors to our website bpo.citisumma.com

  • Our current and potential clients (natural persons or representatives of legal entities)

  • Any person whose personal data is processed by Summa in the course of our commercial and direct marketing activities

  • Personal data processed by Summa as a Data Processor, in which case the applicable terms are complemented by the Data Processing Agreements signed with our Clients (Data Controllers)


3. PERSONAL INFORMATION WE COLLECT

We may collect and process the following categories of personal data:

When acting as a Data Controller:

  • Identification Data: Name, surname, type and ID number

  • Contact Data: Email address, phone number, mailing address, job title, and company

  • Technical and Browsing Data: IP address, browser type, operating system, website activity (pages visited, time spent), cookies (see our Cookie Policy)

  • Professional Data: Company information, industry, service needs

  • Financial Data: Billing and payment information (when you contract our services)

  • Communication Records: Logs of correspondence and communications with us

When acting as a Data Processor (on behalf of our Clients):
The nature and categories of personal data we process as a Data Processor depend entirely on the BPO services contracted by our Client and the data they provide or instruct us to collect. These may include, among others, data of the Client’s customers, employees, or suppliers. Processing is conducted strictly according to the Client’s documented instructions and under the relevant Data Processing Agreement.


4. PURPOSES OF PERSONAL DATA PROCESSING

When acting as a Data Controller:

  • To provide and manage our BPO services

  • To establish and maintain contractual or commercial relationships with our Clients

  • To respond to inquiries, requests, complaints, and claims

  • To carry out marketing and advertising activities (with prior consent when required)

  • To send informational communications about our services, events, or relevant news

  • To improve our website, services, and user experience

  • To comply with legal, accounting, and tax obligations

  • To perform internal statistical and market analysis

  • To ensure the security of our facilities and information systems

When acting as a Data Processor:

  • To deliver the specific BPO services contracted by the Client (Data Controller), following their documented instructions and purposes

  • To comply with contractual obligations established in the Data Processing Agreement


5. LEGAL BASIS FOR PROCESSING

We process your personal data based on one or more of the following legal grounds:

  • Your Consent: For specific purposes such as sending marketing communications, or when legally required

  • Performance of a Contract: To fulfill our contractual obligations to you or take pre-contractual steps at your request

  • Legal Obligation: When processing is necessary to comply with applicable laws

  • Legitimate Interest: When we have a legitimate interest in processing your data, provided it does not override your fundamental rights and freedoms (e.g., improving our services, preventing fraud)

When acting as a Data Processor, our Clients are responsible for ensuring that there is a valid legal basis for the data processing they entrust to us.


6. HOW WE SHARE YOUR PERSONAL INFORMATION

We do not sell or rent your personal data to third parties. We may share your information under the following circumstances:

  • Service Providers (Sub-Processors): We may share data with third parties that provide services to us (e.g., web hosting, CRM platforms, analytics, legal or accounting advisors). They will act as Data Processors under our instructions and are contractually obligated to protect the data.

  • Clients (when acting as a Data Processor): We will share data processed on behalf of a Client only with that Client, according to their instructions.

  • Legal Authorities: When required by law or necessary to protect our rights, property, or safety, or those of third parties.

  • Business Transactions: In the event of a merger, acquisition, asset sale, or corporate reorganization, your data may be transferred to the successor entity.

  • With Your Consent: We may share your information with third parties when we have your explicit consent to do so.


7. INTERNATIONAL DATA TRANSFERS

If we transfer personal data to countries that do not offer data protection levels equivalent to those of Colombia (or your jurisdiction, if applicable), we will implement appropriate safeguards (such as standard contractual clauses or adherence to recognized certification frameworks) to ensure your personal data remains protected in accordance with this Policy and applicable law.


8. DATA SECURITY

We have implemented appropriate and reasonable technical, administrative, and physical measures to protect personal information against loss, misuse, unauthorized access, disclosure, alteration, or destruction, in accordance with industry standards and applicable law. These include access controls, encryption (where appropriate), security policies, staff training, and confidentiality agreements.


9. DATA RETENTION

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, to comply with legal, contractual, or reporting requirements, or for dispute resolution. The specific retention period depends on the nature of the data and the processing purposes. Once no longer necessary, we will securely delete or anonymize your personal data.


10. YOUR RIGHTS AS A DATA SUBJECT

Under Law 1581 of 2012 and its regulations, you have the following rights regarding your personal data:

  • To access, update, and correct your personal data

  • To request proof of consent given for processing (except in legal exceptions)

  • To be informed about how your data is used

  • To file complaints with the Superintendence of Industry and Commerce (SIC) regarding violations of data protection law

  • To revoke your consent and/or request deletion of your data when legal grounds no longer apply or your rights have been violated

  • To access your personal data for free, at least once per calendar month, or each time there are substantial updates to this Privacy Policy that warrant new inquiries

How to Exercise Your Rights:
You may exercise your rights by submitting a written request to our Data Protection Officer via:

  • Email: [Data Protection Contact Email, e.g., privacidad@summa.com.co]

  • Postal Address: [Full Physical Address of Summa, Medellín, Colombia], Attn: Data Protection Officer

Your request must include at least:

  • Full name and contact information (address, phone, email)

  • Clear description of the personal data concerned and the rights being exercised

  • Any additional documents or details that help locate the data

  • A copy of your ID or equivalent document verifying your identity

We will respond within the legal timeframes (generally 10 business days for inquiries and 15 business days for complaints, extendable as permitted by law).


11. COOKIE POLICY

Our website uses cookies and similar technologies to enhance your browsing experience, analyze traffic, and personalize content. For more details on how we use cookies and how to manage them, please refer to our [link to Cookie Policy, if separate, or brief description here].


12. CHILDREN’S PRIVACY

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors without verifiable parental or legal guardian consent. If we become aware that we have collected personal information from a minor without such consent, we will take steps to delete it.


13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to reflect changes in our data practices or in applicable law. We will notify you of material changes by posting the updated policy on our website and indicating the date of the latest revision. We encourage you to review this Policy regularly.


14. CONTACT

If you have any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact our Data Protection Officer:

Summa
Attn: Data Protection Officer
Cra. 19b #83-63, Bogotá, Colombia
📧 contacto@summavalor.com.co
📞 +57 313 261 7461

Scroll to Top

Schedule a Teleconsultation

Agenda una teleconsulta