Personal Data Processing Policy

Effective as of July 26, 2026.

Courtesy translation. This is an English rendering of a policy issued in Spanish under Colombian law. If the two versions differ, the Spanish version is the one that governs.

This policy describes how Webbidor collects, uses, stores and protects personal data, in compliance with Colombian Law 1581 of 2012, Decree 1377 of 2013 and other Colombian personal data protection regulations.

1. Data controller

Nestor Fabio Gómez Toro, an individual operating under the trade name Webbidor.

National ID: 1.060.651.934
Address: Calle 45 #29-24, Manizales, Caldas, Colombia
Email: contacto@webbidor.com
Phone and WhatsApp: +57 323 374 8400

The channel for questions and complaints regarding personal data is the email address above.

2. Two distinct roles

Webbidor processes personal data in two different capacities, and the distinction matters because the responsibilities are not the same.

As Controller

For the data of people who contact us directly: website visitors, people who fill out the contact form or message Webbidor on WhatsApp, and contact persons at our clients. For this data, Webbidor determines the purposes and answers directly to the data subject.

As Processor

For the data of our clients' own end customers: the people who message the WhatsApp number of a business using an assistant configured by Webbidor. In those cases, the Controller is the contracting business, not Webbidor. Webbidor processes that data only under that business's instructions and in order to provide the contracted service. Data subject requests concerning that data must be directed to the corresponding business, although Webbidor cooperates in handling them.

3. What data we process

On the website

Data you provide in the contact form: name, phone number, business name, sector and the message you write.
Browsing data collected by analytics and advertising tools (Google Analytics and Google Ads): pages viewed, traffic source, device and cookie identifiers. This data is used in aggregate form to understand how the site performs.

In the WhatsApp assistants

Phone number and profile name of the person writing.
Content of the messages exchanged with the assistant.
The data the conversation is designed to collect according to the business process: for example, service requested, address or area, preferred date or order details.

We do not collect data that is not necessary for the process the assistant handles.

4. Purposes

Responding to information requests and preparing commercial proposals.
Providing, operating, monitoring and improving the contracted automation services.
Recording requests, appointments or orders in the tools the contracting business indicates.
Sending follow-up, reminder or confirmation messages related to the process being handled.
Complying with legal, accounting and tax obligations.
Measuring the performance of the website and of advertising campaigns.

We do not sell, rent or transfer personal data to third parties for commercial purposes.

5. Third parties involved

To provide the service we rely on technology vendors that may process data on our behalf or on behalf of the contracting business:

Meta Platforms — operation of the WhatsApp Business channel.
Google — spreadsheets, calendar, analytics and advertising.
Language model providers — processing of messages to generate the assistant's replies.
Infrastructure provider — servers where the platform runs.
Formspree — processing of the website contact form.

You may request the current list of vendors by writing to contacto@webbidor.com.

6. International data transfers

The vendors listed above operate servers outside Colombia. In particular, the content of messages is sent to a language model provider located abroad in order to generate the assistant's reply. This constitutes an international transfer of personal data.

By using an assistant operated by Webbidor, or by contracting our services, the data subject and the contracting business authorize this transfer. Contracting businesses must disclose this circumstance to their own end customers in their own data policy.

7. Sensitive data

Webbidor's assistants are not designed to process sensitive data: health data, biometric data, financial data such as card numbers, or identity documents.

The assistants are configured to explicitly ask users not to share that kind of information over chat. If it is received anyway, it is deleted from the record. We do not provide automation services for healthcare practices or for processes involving clinical data.

8. Retention

Commercial contact data is retained for as long as a commercial relationship or interest exists, and afterwards for as long as legal obligations require.
Conversation history is retained for the period agreed with each contracting business in its support plan.
Records of requests, appointments or orders remain in the contracting business's own tools and their retention is that business's responsibility, as Controller.
On termination of a contract, Webbidor deletes the operational copies under its control within the following 60 days, except for what it must retain by legal obligation.

9. Data subject rights

Under article 8 of Colombian Law 1581 of 2012, you have the right to:

Access, update and correct your personal data.
Request proof of the authorization granted, except where the law does not require it.
Be informed about how your data has been used.
File complaints with the Superintendency of Industry and Commerce for breaches of the law.
Revoke the authorization or request deletion of the data, where no legal or contractual duty prevents it.
Access your personal data free of charge.

10. How to exercise your rights

Write to contacto@webbidor.com stating your name, a contact detail, a description of your request and any documents you wish to rely on.

Queries: answered within a maximum of ten (10) business days. If that is not possible, you will be told why and given the date on which it will be answered, which will not exceed five (5) additional business days.
Complaints: answered within a maximum of fifteen (15) business days. If that is not possible, you will be told why and given the new date, which will not exceed eight (8) additional business days.

If your request concerns a conversation held with a business's assistant, tell us which business it is: as Processors, we will forward the request to the Controller and cooperate in handling it.

11. Security

We apply reasonable technical and administrative measures to protect data: restricted access to credentials and systems, encryption in transit, and separation between each client's information. No measure removes risk entirely; in the event of a security incident affecting personal data, we will notify those affected and the competent authority as required by law.

12. Data obtained from Google APIs

When a client connects their Google account to Webbidor, they do so through Google's consent screen, granting specific permissions that they can revoke at any time from their Google account settings.

Which permissions we request and why. We request only the narrowest permission that solves each automation:

Google Calendar — checking availability and creating, modifying or cancelling the appointments for the process the client contracted us for.
Google Sheets — reading and writing the spreadsheets the client designates as the destination for their records or reports.
Google Drive — access limited exclusively to files the application creates or that the user opens with it. We do not request access to the rest of the Drive contents.

How we use, store and share it. This data is used only to run and display the functionality the client contracted. We do not use it for advertising, we do not sell it, we do not transfer it to data brokers or to third parties for commercial purposes, and we do not use it to determine creditworthiness or for credit assessment. It is not used to train artificial intelligence models. We store access credentials encrypted and separated per client, and we retain the minimum content necessary to operate the process. No one at Webbidor accesses this data, except with the client's express authorization, for security reasons, to resolve a fault the client reports to us, or where required by law. On termination of the contract, or on revocation of the permission, we stop accessing the account and delete the operational copies under our control.

Webbidor's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13. Effective date and changes

This policy is effective as of July 26, 2026. Databases will remain active for as long as the purpose that justified their collection lasts. Any substantial change will be published on this same page with its new effective date.

Have a question about your data? Write to us at contacto@webbidor.com. See also our Terms of service.