Personal Data Processing Policy
FUNDACIÓN MASPAZION
Colombian Law 1581 of 2012 and applicable regulations
This is a courtesy translation. The official document is the Spanish version, which prevails in the event of any difference.
1. DATA CONTROLLER.
FUNDACIÓN MASPAZION, whose principal place of business is in Santiago de Cali, Valle del Cauca, will be the Data Controller of the personal data it collects and decides to process.
Address: Avenida 5 Norte # 26N-78, Santiago de Cali, Valle del Cauca, Colombia
Data protection email: contacto.maspazion@gmail.com
Phone: +57 316 337 7737
Responsible for handling inquiries and complaints: the Legal Representatives of the Foundation, María Jimena Fernández Merchán and Adriana Alexandra Robledo Arce.
2. PURPOSE.
This Policy sets out the rules for the collection, storage, use, circulation, transmission, transfer, updating, correction, consultation, deletion and other Processing operations on personal data carried out by the Foundation in the course of its social, sports, educational, administrative, contractual, cooperation, communication and institutional relations activities.
3. PRINCIPLES.
Lawfulness, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality.
Minimization: the Foundation will endeavor to collect only the data that are adequate, relevant and necessary for each purpose.
Demonstrated accountability: the Foundation will keep reasonable records of authorizations, security measures and the handling of rights.
4. CATEGORIES OF DATA SUBJECTS.
Participating girls, boys and adolescents.
Adult participants, families, guardians and emergency contacts.
Founders, members of governing bodies and legal representatives.
Employees, contractors, facilitators, coaches, volunteers, interns and candidates.
Donors, funders, sponsors, partners, suppliers and institutional contacts.
Visitors, users of digital channels and people who communicate with the Foundation.
5. DATA THAT MAY BE PROCESSED.
Identification and contact data.
Data on participation in programs, attendance, results, evaluations and follow-up.
Information on guardians, authorized persons and emergency contacts.
Academic, employment, professional or contractual data when relevant.
Financial, tax, banking and payment data when there is an economic relationship.
Image, voice, photographs, videos and testimonials when there is a legal basis and the applicable authorizations.
Strictly necessary sensitive data, such as health information relevant to the safety of an activity, ethnic origin or other data requiring enhanced protection.
6. PURPOSES OF PROCESSING.
To register, invite, admit, organize and support participants in programs, workshops, training sessions, tournaments, events, trips and activities.
To manage attendance, safety, emergency contacts and responses to health or protection situations.
To carry out projects, agreements, contracts and obligations with funders, partners and authorities.
To carry out follow-up, evaluation, systematization and measurement of results and impact.
To manage employment, contractual, volunteer and supplier relationships and payments.
To comply with legal, accounting, tax, audit, safeguarding and reporting obligations.
To send information about activities, calls and matters related to the existing relationship with the Data Subject.
To produce and disseminate institutional content when there is authorization for image, voice, testimonials or audiovisual material.
To manage donations, sponsorships, cooperation and institutional relations.
To respond to inquiries, requests, complaints, incidents and the exercise of Data Subjects’ rights.
To maintain the security of the Foundation’s systems, facilities, files and resources.
7. SENSITIVE DATA.
Sensitive data will receive enhanced treatment. Before requesting authorization, the Foundation will explicitly state which data are sensitive, the purpose for which they are requested and that, as a general rule, the Data Subject is not obliged to authorize their Processing. The Foundation will not unjustifiably make participation in an activity conditional on providing sensitive data.
Health information requested for activities with participants will be limited to what is reasonably necessary to manage safety, first aid, restrictions or emergencies.
8. DATA OF GIRLS, BOYS AND ADOLESCENTS.
The Processing of data of girls, boys and adolescents will be exceptional and must respond to and respect their best interests, ensure respect for their fundamental rights and be limited to legitimate purposes necessary for the Foundation’s programs.
Authorization will be granted by the person empowered to represent the minor, after the child or adolescent has exercised their right to be heard according to their age, maturity, autonomy and capacity to understand the Processing. The Foundation will endeavor to explain the use of their data, image and voice in understandable language.
A minor’s refusal to be photographed, recorded or interviewed will be respected when their age and maturity allow them to understand the decision, even if their legal representative has given general authorization, except for a legal or safety purpose that does not depend on consent.
9. AUTHORIZATION.
The Foundation will request prior, express and informed authorization no later than the time of collection, except for legal exceptions. Authorization may be recorded in writing, by electronic means or through other mechanisms that allow it to be demonstrated. Proof of the authorizations granted will be kept.
When the purposes of Processing change substantially and the change affects the scope of the authorization, the Foundation will inform the Data Subject and obtain a new authorization where appropriate.
10. IMAGE, VIDEO AND VOICE.
Image and voice will be processed for the specifically authorized purposes. Authorization for their capture and dissemination will be separate from the general authorization to participate in the programs.
Refusing to authorize the public dissemination of image or voice will not prevent participation in the Foundation’s activities. When it is necessary to capture images or voice for a purpose other than public dissemination, that purpose will be specifically communicated and the corresponding authorization will be requested, unless an applicable legal exception exists.
The Foundation will apply enhanced measures when the content involves minors, situations of vulnerability, violence, health or other sensitive information. It will not publish content that is humiliating, sexualized or that exposes unnecessary information.
11. RIGHTS OF DATA SUBJECTS.
To know, update and correct their personal data.
To request proof of the authorization, except when it is not legally required.
To be informed about the use given to their data.
To file complaints with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio) once the corresponding procedure before the Foundation has been exhausted, where applicable.
To revoke the authorization and/or request deletion when appropriate.
To access free of charge the personal data subject to Processing under the terms of the law.
12. INQUIRIES AND COMPLAINTS.
Data Subjects, their representatives or persons authorized by law may submit inquiries and complaints to contacto.maspazion@gmail.com or through the other channels published by the Foundation.
To handle a request, the Foundation may require information to verify the identity of the person submitting it or the capacity in which they act.
Inquiries: will be answered within a maximum of ten (10) business days from the date of receipt. If it is not possible to respond within that period, the Foundation will state the reasons and the response date before it expires. The additional period may not exceed five (5) business days from the expiry of the first period.
Complaints: must contain the identification of the Data Subject, a description of the facts, contact details and the documents to be relied upon.
If the complaint is incomplete, the Foundation will request the missing information within five (5) business days of receipt. If two (2) months pass from that request without the requested information being submitted, the person will be deemed to have withdrawn the complaint.
Once the complete complaint has been received, the Foundation will include in the corresponding database the legend “complaint in process” (“reclamo en trámite”) and the reason for it, within no more than two (2) business days. The legend will remain until the complaint is decided.
Complaints will be answered within a maximum of fifteen (15) business days from the day after receipt. If it is not possible to respond within that period, the Foundation will state the reasons and the response date before it expires. The additional period may not exceed eight (8) business days from the expiry of the first period.
Requests relating to girls, boys and adolescents will be handled in accordance with the law, verifying the power of representation where appropriate and taking their opinion into account according to their age and maturity.
13. DATA PROCESSORS, TRANSMISSIONS AND THIRD PARTIES.
The Foundation may use providers of technology, storage, communications, accounting, payments, evaluation, logistics or other services acting as Data Processors. Where appropriate, it will establish contractual obligations of confidentiality, security, limited use and return or deletion of the information.
The national or international transfer or transmission of data will be carried out in accordance with applicable Colombian legislation and with the relevant authorizations or legal exceptions.
We use an analytics tool that does not place cookies in our visitors’ browsers, to learn in aggregate how many visits the page receives and where they come from. We do not use it to identify people.
14. SECURITY AND CONFIDENTIALITY.
Access limited according to functions and need to know.
Passwords and access controls appropriate to the systems used.
Backup and reasonable preservation of institutional information.
Separation of, or restricted access to, sensitive data and safeguarding reports.
Confidentiality obligations for staff and contractors with access to information.
Response to and documentation of security incidents and, where appropriate, reporting to the competent authorities.
15. RETENTION AND DELETION.
The Foundation’s databases will remain in force for as long as necessary to fulfill the purposes communicated to Data Subjects and, thereafter, for the periods required to meet legal, contractual, accounting or tax obligations, as well as to defend rights and handle claims.
The Foundation will define retention periods according to the type of information, the purpose of its Processing and the applicable obligations. Once the purpose has been fulfilled and the corresponding periods have expired, it will delete, anonymize or keep the information under restricted conditions, as appropriate.
Requests for deletion of data or revocation of authorization will be handled in accordance with the law. When there is a legal or contractual duty to retain certain data, the Foundation will inform the requesting person of this situation.
16. PRIVACY NOTICE.
When it is not possible to make this complete Policy available to the Data Subject at the time of collection, the Foundation will use a Privacy Notice that identifies the Data Controller, explains the Processing and its purposes, informs the Data Subject of their rights and indicates how to consult this Policy.
17. RESPONSIBLE PERSON OR AREA.
The Legal Representatives of the Foundation will be responsible for handling Data Subjects’ requests and supporting the implementation of this Policy, without prejudice to the responsibilities of other people who process information.
18. CHANGES TO THE POLICY.
The Foundation will communicate substantial changes to this Policy to Data Subjects by reasonable means and before they are implemented.
When the change affects the purposes of Processing and requires a new authorization under the law, the Foundation will request it before beginning Processing for the new purpose.
19. EFFECTIVE DATE.
This Policy takes effect on the day of its publication on the Foundation’s website and will remain in force until it is modified or replaced.
The validity of the databases will be governed by section 15 of this Policy.
Publication date: October 30, 2026
Last updated: November 1, 2026