Personal Data Policy

Effective October 21, 2026.

Notable Source takes care of the personal data it receives. This policy explains what data we handle, why, who we share it with, and how you can access, correct or delete it, under Colombia's Law 1581 of 2012 and Decree 1074 of 2015.

1. Who is responsible

• Name: Diego Alejandro Peñuela Goyes, an individual providing professional services under the Notable Source brand.
• Domicile: Sabaneta, Antioquia, Colombia.
• Address: Calle 65 Sur # 39-235, Sabaneta, Antioquia, Colombia.
• Email for personal data matters: contact@notablesource.co
• Phone: +57 310 381 7860
• Website: notablesource.co

2. What data we handle, and whose

We don't ask for sensitive data (health, racial or ethnic origin, political views, religious beliefs, sex life or biometric data, among others) for our own business. If a sensitive detail passes through our hands in a client project, we handle it only on the client's behalf, under their instructions and authorization, and never use it for anything else. Answering questions about sensitive data is always optional.

We don't handle data about children or teenagers for our own business. Our services are for businesses and adult professionals.

3. What we use the data for

1. Answering requests, preparing proposals and following up with people who contacted us.
2. Signing and carrying out contracts, invoicing, collecting payment and meeting accounting and tax obligations.
3. Providing the contracted services: websites, visibility in search engines and AI assistants, social media, digital security and our own tools.
4. Sending information about our services only to people who agreed to it, with the option to stop at any time.
5. Keeping the website and our systems secure.
6. Responding to requests from authorities.

We don't sell, rent or hand over personal data to third parties for their own use.

4. Use of artificial intelligence

We use AI tools from outside providers to support our work (writing, analysis and programming). We have them set so they don't use our conversations to train their models. Every decision and every deliverable is reviewed by a person. We make no automated decisions that have legal effects on anyone.

5. Who we share data with

To operate, we use providers that handle data on our behalf. Some are outside Colombia, mainly in the United States:

By authorizing us to handle your data, you agree that it may be processed by these services, including outside Colombia, only for the purposes in this policy.

6. Your rights

Under Law 1581 of 2012, art. 8, you can:

1. Access, update and correct your data.
2. Ask for proof of the authorization you gave us, except where the law doesn't require it.
3. Know how we have used your data.
4. File complaints with Colombia's Superintendence of Industry and Commerce (SIC), after going through our process first.
5. Revoke your authorization or ask us to delete your data, when there is no legal or contractual duty to keep it.
6. Access your data free of charge.

7. How to exercise them

• Channel: email contact@notablesource.co with the subject "Personal data".
• Who handles it: Diego Alejandro Peñuela Goyes.
• Inquiries (what data we hold and how we use it): we answer within ten (10) business days. If that isn't possible, we tell you why and answer within the next five (5) business days (Law 1581, art. 14).
• Claims (correct, update, delete or revoke): we answer within fifteen (15) business days. If that isn't possible, we tell you why and answer within the next eight (8) business days (Law 1581, art. 15). If a claim is incomplete, we ask for what's missing within five (5) days; if it doesn't arrive within two (2) months, we consider the claim withdrawn.
• To protect your data, we may ask you to confirm your identity.

8. Authorization

We ask for your authorization before handling your data: in writing, verbally, or through an action that clearly shows you gave it, such as ticking the box on our form. We keep proof of that authorization. Authorization isn't needed for public data or in the other cases listed in art. 10 of Law 1581.

9. When we handle data on behalf of our clients

When a client gives us data about its own customers, employees or suppliers (for example, for its website, social media, our own tools or a digital security review), the client is responsible and we act on its behalf. In that case:

• We use the data only for the contract and according to the client's instructions.
• We apply security measures, keep it confidential and never use it for our own purposes.
• When the contract ends, we return or delete the data within the agreed time and keep a record.
• The client guarantees it has the authorization of the people involved.

10. Security

We apply measures that are reasonable for our size: least-privilege access, two-step verification on accounts that allow it, passwords in an encrypted manager, read-only tools when reading is enough, and access logs in our tools. When we review a client's security, we never ask for or keep their passwords. If an incident affects your data, we contain it, assess what was affected, notify you, and report it to the SIC when required.

11. How long we keep data

For as long as the relationship lasts and as needed for its purpose, plus the time required by accounting, tax and commercial rules. Data from people who contacted us and didn't become clients is deleted twelve (12) months after the last contact, unless they ask us to stay in touch.

12. Effective date and changes

This policy is effective as of October 21, 2026. If it changes substantially, we will post a notice on this site and, where the law requires it, ask for new authorization. Databases are kept for as long as the purposes described here apply.