1. Controller
Juan Manuel Arboleda Orozco, CC 1193570960, Santiago de Cali, Colombia, fembot@femmeza.shop. Brand: FemBot. Data-protection contact for requests, queries and claims: FemBot's owner, at the same email.
2. Two different roles
| Data | Controller | Processor |
|---|---|---|
| A. People who hire FemBot (contacts of client businesses and the waitlist: name, email, phone, tax ID, plan, payment and support history) | FemBot | Mercado Pago (payments), Shopify (site and forms), email provider, e-invoicing provider, hosting/secure access |
| B. Each client business's customers (name, phone, address, ID number if the business asks, conversations, orders) | The client business | FemBot, on Entrepreneur and Business plans. On Basic the data is on the business's computer; FemBot accesses it only for support |
This policy covers data A. FemBot handles data B only on behalf of and per the instructions of each business, under the processing agreement; those customers exercise their rights before the business, and FemBot gives it the tools to respond.
3. Processing and purposes
| Purpose | Data | Basis |
|---|---|---|
| Answer enquiries about FemBot | Name, email, phone, message | Consent (form) |
| Manage the waitlist and notify when places open | Name, email, phone, plan of interest | Consent |
| Enter into and perform the subscription: onboarding, installation, support, invoicing, collection, overdue notices | ID, contact, plan, payment data without card numbers | Contract and consent |
| Issue electronic invoices (when the law requires) and meet tax and accounting duties | Tax ID, name, address, email | Legal duty |
| Security, fraud prevention and chargebacks | Access and payment logs | Legitimate interest with consent |
| Improve the service with aggregated statistics (no identification) | Anonymised data | — |
| Send FemBot news (only if the specific box is ticked) | Name, email | Separate, revocable consent |
We do not sell data, do not use it to train AI models, and do not profile people. Sensitive data (health, biometric, etc.) is not requested in FemBot's forms; if someone writes it in a free-text message, answering is optional and it is used only to handle that message. FemBot is not aimed at minors; data of a minor without a representative's authorisation is deleted.
4. Your rights (Law 1581, art. 8)
(a) Know, update and rectify your data; (b) request proof of consent; (c) be informed of how your data has been used; (d) complain to the SIC; (e) revoke consent and/or request deletion where principles, rights and guarantees are not respected (not available if you have a legal or contractual duty to remain in the database, e.g. invoices must be kept); (f) free access to your data.
5. How to exercise them and deadlines
- Channel: email fembot@femmeza.shop, subject "Personal data". Free of charge.
- Include: full name, ID, a way to reply, a clear description and, for claims, supporting documents; proof of authority if you act for someone.
- Queries: answered within 10 business days; if impossible, we tell you why and the new date, which will not exceed 5 additional business days (Law 1581, art. 14).
- Claims (correct, update, delete, revoke, alleged breach): answered within 15 business days. If incomplete, we ask within 5 days; after 2 months without a reply it is deemed withdrawn. If we cannot answer on time we say why, with a new date no later than 8 business days after. Meanwhile the data is flagged "claim in process" (art. 15).
- Prerequisite: you may complain to the SIC only after going through this procedure with FemBot (art. 16).
- We give you a reference number with date and time.
6. Processors, transmissions and transfers
- Third parties that process data on our behalf include Mercado Pago, Shopify, an email provider, an e-invoicing provider and a hosting/secure-access provider. Several are outside Colombia.
- Transmission to a processor does not need new consent where a transmission contract exists under art. 25 of Decree 1377 (art. 24 no. 2). FemBot uses only processors committed to this policy, with security and confidentiality.
- A transfer to a third party who becomes its own controller is made only with express consent or to countries with an adequate level recognised by the SIC (Law 1581, art. 26).
- Customer data of the businesses may be stored on servers in the European Union, which is on the SIC's list of adequate countries.
7. Security and retention
Reasonable technical and organisational measures: encrypted backups (AES-256-GCM), isolation between businesses, logs without personal data, access control and incident response. In a security incident affecting list A we will report to the SIC when applicable and notify those affected; for list B we notify the responsible business without delay. Retention: for the relationship plus what tax, accounting and commercial law require (up to 10 years for invoices); waitlist requests, up to 12 months if not converted. Customer data of businesses is returned and deleted at the end of the contract (30 days to export; verifiable deletion on day 60).
8. Validity and changes
Effective 7 October 2026. The validity of the database is that of its purpose and legal retention duties. Material changes are communicated before applying them, by email and on the site.
9. National Database Registry (RNBD)
Under Decree 090 of 2018, registration applies to companies and non-profits with total assets above 100,000 UVT (COP 5,237,400,000 at the 2026 UVT of COP 52,374). If FemBot becomes obliged it will register within the legal term.
Document drafted on the basis of the law in force; it does not replace a lawyer's advice.