ES | EN

Privacy Policy (Personal Data Processing Policy)

Last updated and effective date: October 5, 2026
Where this policy is published: this page
Spanish version: Política de Tratamiento de Datos Personales

This is the English version of my Política de Tratamiento de Datos Personales. It is governed by Colombian law (Law 1581 of 2012 and its regulations). If there is any discrepancy between the two versions, the Spanish version prevails.

In this policy I explain, in plain language, what personal data I collect, what I do with it and why, who I share it with, and how you can exercise your rights. If anything is unclear, write to me and I'll be glad to explain.

1. Who is responsible for your data?

I personally handle all questions, complaints and requests about your personal data.

2. What data do I collect, and how?

I collect your data only through the sign-up form on my page (a landing page with a Brevo form):

Data Required?
Work email address Yes
Name No (optional)
Your authorization (checkbox you tick) Yes

In addition, the email platform (Brevo) automatically records some technical data:

Section 3 explains what I use each of these for.

I don't ask for sensitive data (health, ethnic origin, beliefs, biometric data, etc.) or financial data. Please don't include it if you write to me.

3. What do I do with your data, and why?

3.1 How your data is processed

Processing of your data consists of: collection, storage, use, circulation (including transmission to my data processor, Brevo) and, where applicable, deletion.

3.2 What I use it for

I use your data only to:

  1. Send you the free sample of the "LATAM Fintech Company Directory 2026 (CO · MX · CL · BR)" (free sample of 4 companies).
  2. Send you up to 3 related emails about that directory, including information about the full version (paid product, $29, sold on Gumroad).
  3. Answer your questions if you write to me.
  4. Keep proof of your authorization: for this I use the date, time and IP address of your sign-up.
  5. Measure the delivery of those emails and improve them: for this, Brevo records whether you open the emails or click their links. I use this only for that purpose, not to sell your data or for any other purpose. If you don't want this open and click tracking, you can unsubscribe or write to me to limit that use to the extent the platform allows.
  6. Handle your requests about your data (inquiries and complaints).

I will not use your data for other purposes without asking for a new authorization.

4. On what basis do I process your data?

Your prior, express and informed authorization, which you give by ticking the checkbox on the form before submitting it. The checkbox is never pre-ticked. Next to it I tell you who I am and how to contact me (address, phone and email), what data I process and how, for what purposes, what your rights are and where this policy is.

I keep a record of that authorization (date, time and IP address of the sign-up) so I can prove it if needed.

5. Who do I share your data with?

I don't sell or rent your data.

5.1 Brevo: my data processor (transmission)

I use Brevo (Sendinblue SAS), domiciled at 17 rue Salneuve, 75017 Paris, France (RCS Paris 498 019 298), to host the sign-up form, store the subscriber list and send the emails. Brevo processes your data on my behalf and following my instructions; under Colombian law it is a data processor (encargado del tratamiento), and giving it the data is a transmission (transmisión).

Brevo processes the data on servers outside Colombia (European Union: OVH in France and Germany; storage on Google Cloud in Belgium, according to its data location documentation). Because Brevo acts as my processor, this is a transmission governed by Article 2.2.2.25.5.1 of Decree 1074 of 2015: it does not require an additional authorization from you as long as there is a transmission contract that sets the scope of the processing, the activities the processor carries out on my behalf, and its obligations of security, confidentiality and compliance with this policy (Article 2.2.2.25.5.2). The transmission contract is Brevo's Data Processing Agreement (DPA), which is Appendix 3 of its Terms of Service and has been in force since I accepted them when creating the account (Brevo Terms of Service, including the DPA).

5.2 Gumroad: acts under its own policy

Gumroad does not receive my subscriber list data from me. It only comes into play if you decide to go to Gumroad to download the free sample ($0) or buy the full version. In that case, the data you give Gumroad (for example, for your account, the download or the payment) is processed by Gumroad as an independent controller, under its own privacy policy, and your relationship with Gumroad is governed by that policy. I recommend reading it before using the platform.

5.3 Transfers to other controllers

I will only hand over your data to another controller or to an authority when the law, a court or administrative order, or one of the exceptions in Article 26 of Law 1581 of 2012 allows it, or when you authorize it expressly and unequivocally.

6. Your rights

As the data subject (titular), you have the right to:

Unsubscribing is immediate: every email includes an unsubscribe link. Once you use it, you stop receiving messages.

7. How to exercise your rights (inquiries and complaints)

Write to me at jpac.647@gmail.com with the subject line "Personal data" (or "Datos personales"). If you prefer, you can also call me at +57 300 663 3944 or send a letter to Calle 49c 96b 28, Apto 101, Medellín 050035, Colombia. Please include:

I may ask you to confirm your identity (for example, by replying from the subscribed email address) before providing or changing any information.

Response times (as set by law):

While a complaint is being resolved, I will mark your data as "complaint in progress" (reclamo en trámite) no later than 2 business days after receiving the complete complaint.

I follow a written internal procedure to handle these requests.

8. Security

I apply reasonable measures to protect your data: I use well-known providers with encrypted connections, protect my accounts with strong passwords and two-step verification, and limit access to the data to myself. No system is 100% secure.

If a security incident occurs that breaches security codes or puts the management of data subjects' information at risk, I will act to contain it, report it to the Superintendence of Industry and Commerce in accordance with Article 17(n) of Law 1581 of 2012, and notify you when appropriate so you can take protective measures.

9. How long do I keep your data?

For as long as you remain subscribed or for the time needed to fulfill the purposes of this policy. If you unsubscribe or request deletion, I delete your data or keep it only on a suppression list (so I don't write to you again), unless a legal obligation or the need to handle a complaint requires me to keep it longer.

The subscriber database will remain in force for as long as this service exists.

10. Minors

This service is aimed at professionals and not at anyone under 18. I don't knowingly collect data from minors. If you are a parent or guardian and believe a minor has signed up, write to me and I will delete their data.

11. Changes to this policy

I may update this policy. If I make significant changes (for example, new purposes or new providers), I will publish them on this page with the new date and notify you by email before applying them or, where the law requires it, ask you for a new authorization.

Note for readers in the EU/EEA and the UK

This policy is governed by Colombian law, and this note doesn't change that. In practical terms: processing is based on the consent you give by ticking the checkbox, and you can withdraw it at any time (section 6); the rights to access, correct and delete your data are available to you wherever you live, by writing to me (section 7); and your data is stored by Brevo in the European Union (section 5.1). Depending on where you live, you may also have the right to lodge a complaint with your local data protection authority.

Version 3 (English) – Effective October 5, 2026.