Personal data processing policy
This document meets the requirements of Law 1581 of 2012 of Colombia and its implementing decrees. It complements our privacy policy, which applies to every country and explains how things work in general.
If you are outside Colombia, the privacy policy is the one that applies to you.
Who processes your data, and in what capacity
There are two distinct roles here, and confusing them leads to asking the wrong party:
Cobbi is the controller of the data of the people who open an account: the business owner and anyone they authorise.
Cobbi is the processor of the data of that business's customers. The controller is the business that uploads the data and decides who to charge. We process it under their instructions.
If you are a customer of a business and you received a message from us, the controller of your data is that business, not Cobbi. Below is what you can ask us directly.
What it is processed for
As controller, we process our users' data to create and maintain their account, provide the service, bill their plan, support them, meet legal obligations and improve the product.
As processor, we handle the business's customers' data solely to send the reminders the business schedules, receive their replies and receipts, reconcile payments and keep a record of what was sent. Nothing else.
What data
From our users: name, mobile number, email, tax ID, business details and service usage data.
From the business's customers: name, mobile number, tax ID if the business uploads it, and the information of the charges, invoices, messages and receipts.
We do not deliberately process sensitive data or data of minors. If you notice any was uploaded, tell us and we will delete it.
Your rights as a data subject
The law grants you these rights, and here they work:
- Know what data about you exists and how it is processed.
- Update and correct anything incomplete or wrong.
- Request proof of the authorisation given to process it.
- File complaints with the Superintendency of Industry and Commerce.
- Withdraw authorisation and request deletion of your data, where no legal or contractual duty requires it to be kept.
- Access your data free of charge.
How to exercise them
Write to our privacy address with your request, your name and something that lets us locate you, such as the mobile number the messages arrived at.
The deadlines are the statutory ones: 10 business days for queries and 15 business days for complaints, extendable in the cases the rule allows. If the deadline is extended, we tell you and why.
If you are a customer of a business that uses Cobbi, note that:
- To stop receiving messages, reply BAJA in the same chat. It is immediate, we apply it ourselves, and you need not write to anyone else. It covers everything going from that number to yours.
- To access, correct or delete your data, the request belongs to the business charging you, because they are the controller. If you write to us, we pass it on and tell you who to contact.
Authorisation
The business using Cobbi declares, on accepting our terms, that it has a real commercial relationship with every person it charges and a legitimate basis to process their data and contact them.
Cobbi does not collect that authorisation on their behalf, nor does it verify it.
Retention
Data is kept while the relationship justifying it exists and for the additional time the law requires. The concrete deadlines are in section 7 of the privacy policy.
Controller and contact
The contact details for exercising any of these rights are at the foot of this page.