SUMMA PRIVACY POLICY
Last Updated: May 27, 2025
1. INTRODUCTION AND DATA CONTROLLER
Welcome to Summa (BPO SUMMA). At Summa, we are committed to protecting the privacy and security of the personal data we process. This Privacy Policy explains how we collect, use, store, share, and protect your personal information.
For the purposes of Colombian law (Law 1581 of 2012 and complementary regulations), Summa, located at Cra. 19b #83-63, Bogotá, Colombia, and reachable at contacto@summavalor.com.co, acts as the Data Controller for the personal data it collects directly from its clients, prospects, website users, and employees.
When Summa provides business process outsourcing (BPO) services to its Clients, it acts as a Data Processor for the personal data entrusted to us by those Clients (who act as Data Controllers). In such cases, data processing is governed by the Client’s instructions and specific contractual agreements (Data Processing Agreements).
2. SCOPE OF THIS POLICY
This Policy applies to:
Visitors to our website bpo.citisumma.com
Our current and potential clients (natural persons or representatives of legal entities)
Any person whose personal data is processed by Summa in the course of our commercial and direct marketing activities
Personal data processed by Summa as a Data Processor, in which case the applicable terms are complemented by the Data Processing Agreements signed with our Clients (Data Controllers)
3. PERSONAL INFORMATION WE COLLECT
We may collect and process the following categories of personal data:
When acting as a Data Controller:
Identification Data: Name, surname, type and ID number
Contact Data: Email address, phone number, mailing address, job title, and company
Technical and Browsing Data: IP address, browser type, operating system, website activity (pages visited, time spent), cookies (see our Cookie Policy)
Professional Data: Company information, industry, service needs
Financial Data: Billing and payment information (when you contract our services)
Communication Records: Logs of correspondence and communications with us
When acting as a Data Processor (on behalf of our Clients):
The nature and categories of personal data we process as a Data Processor depend entirely on the BPO services contracted by our Client and the data they provide or instruct us to collect. These may include, among others, data of the Client’s customers, employees, or suppliers. Processing is conducted strictly according to the Client’s documented instructions and under the relevant Data Processing Agreement.
4. PURPOSES OF PERSONAL DATA PROCESSING
When acting as a Data Controller:
To provide and manage our BPO services
To establish and maintain contractual or commercial relationships with our Clients
To respond to inquiries, requests, complaints, and claims
To carry out marketing and advertising activities (with prior consent when required)
To send informational communications about our services, events, or relevant news
To improve our website, services, and user experience
To comply with legal, accounting, and tax obligations
To perform internal statistical and market analysis
To ensure the security of our facilities and information systems
When acting as a Data Processor:
To deliver the specific BPO services contracted by the Client (Data Controller), following their documented instructions and purposes
To comply with contractual obligations established in the Data Processing Agreement
5. LEGAL BASIS FOR PROCESSING
We process your personal data based on one or more of the following legal grounds:
Your Consent: For specific purposes such as sending marketing communications, or when legally required
Performance of a Contract: To fulfill our contractual obligations to you or take pre-contractual steps at your request
Legal Obligation: When processing is necessary to comply with applicable laws
Legitimate Interest: When we have a legitimate interest in processing your data, provided it does not override your fundamental rights and freedoms (e.g., improving our services, preventing fraud)
When acting as a Data Processor, our Clients are responsible for ensuring that there is a valid legal basis for the data processing they entrust to us.
6. HOW WE SHARE YOUR PERSONAL INFORMATION
We do not sell or rent your personal data to third parties. We may share your information under the following circumstances:
Service Providers (Sub-Processors): We may share data with third parties that provide services to us (e.g., web hosting, CRM platforms, analytics, legal or accounting advisors). They will act as Data Processors under our instructions and are contractually obligated to protect the data.
Clients (when acting as a Data Processor): We will share data processed on behalf of a Client only with that Client, according to their instructions.
Legal Authorities: When required by law or necessary to protect our rights, property, or safety, or those of third parties.
Business Transactions: In the event of a merger, acquisition, asset sale, or corporate reorganization, your data may be transferred to the successor entity.
With Your Consent: We may share your information with third parties when we have your explicit consent to do so.
7. INTERNATIONAL DATA TRANSFERS
If we transfer personal data to countries that do not offer data protection levels equivalent to those of Colombia (or your jurisdiction, if applicable), we will implement appropriate safeguards (such as standard contractual clauses or adherence to recognized certification frameworks) to ensure your personal data remains protected in accordance with this Policy and applicable law.
8. DATA SECURITY
We have implemented appropriate and reasonable technical, administrative, and physical measures to protect personal information against loss, misuse, unauthorized access, disclosure, alteration, or destruction, in accordance with industry standards and applicable law. These include access controls, encryption (where appropriate), security policies, staff training, and confidentiality agreements.
9. DATA RETENTION
We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, to comply with legal, contractual, or reporting requirements, or for dispute resolution. The specific retention period depends on the nature of the data and the processing purposes. Once no longer necessary, we will securely delete or anonymize your personal data.
10. YOUR RIGHTS AS A DATA SUBJECT
Under Law 1581 of 2012 and its regulations, you have the following rights regarding your personal data:
To access, update, and correct your personal data
To request proof of consent given for processing (except in legal exceptions)
To be informed about how your data is used
To file complaints with the Superintendence of Industry and Commerce (SIC) regarding violations of data protection law
To revoke your consent and/or request deletion of your data when legal grounds no longer apply or your rights have been violated
To access your personal data for free, at least once per calendar month, or each time there are substantial updates to this Privacy Policy that warrant new inquiries
How to Exercise Your Rights:
You may exercise your rights by submitting a written request to our Data Protection Officer via:
Email: [Data Protection Contact Email, e.g., privacidad@summa.com.co]
Postal Address: [Full Physical Address of Summa, Medellín, Colombia], Attn: Data Protection Officer
Your request must include at least:
Full name and contact information (address, phone, email)
Clear description of the personal data concerned and the rights being exercised
Any additional documents or details that help locate the data
A copy of your ID or equivalent document verifying your identity
We will respond within the legal timeframes (generally 10 business days for inquiries and 15 business days for complaints, extendable as permitted by law).
11. COOKIE POLICY
Our website uses cookies and similar technologies to enhance your browsing experience, analyze traffic, and personalize content. For more details on how we use cookies and how to manage them, please refer to our [link to Cookie Policy, if separate, or brief description here].
12. CHILDREN’S PRIVACY
Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors without verifiable parental or legal guardian consent. If we become aware that we have collected personal information from a minor without such consent, we will take steps to delete it.
13. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy periodically to reflect changes in our data practices or in applicable law. We will notify you of material changes by posting the updated policy on our website and indicating the date of the latest revision. We encourage you to review this Policy regularly.
14. CONTACT
If you have any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact our Data Protection Officer:
Summa
Attn: Data Protection Officer
Cra. 19b #83-63, Bogotá, Colombia
📧 contacto@summavalor.com.co
📞 +57 313 261 7461