Personal data deletion policy

It applies to anyone whose data we have handled: visitors to our site, prospects, contacts belonging to our business clients, and people who talk to the WhatsApp, web or phone assistants we operate.

It sits alongside our privacy policy. Where the two differ on the deletion procedure, this document governs.

This is the question that decides who you should write to, and the answer is not always us. Law 1581 of 2012 draws a line between two roles:

• Data controller — whoever decides what the data is used for.
• Data processor — whoever handles it on the controller's instructions.

Across much of what we do we are the processor, not the controller: we handle data on behalf of the company that hired us.

Knocking on the wrong door costs you nothing. If you write to us and the controller is someone else, we do not file your request away: we pass it on, and tell you to whom and when.

The channel

Write to privacy@novieri.com. It is the only official channel and it is staffed on business days. We charge nothing for handling your request.

What to include

So that we can find you in our systems and not delete somebody else's data, we need:

If you are writing on someone else's behalf, attach the power of attorney or the document establishing your authority. Where the person is a minor, the request comes from whoever holds parental authority.

If the controller is a client of ours

Where the data belongs to a business using our platform — your WhatsApp conversations with a restaurant, for example — the decision to delete is theirs. What we do, within three (3) business days at most, is:

1. Confirm we received the request and give you a reference number.
2. Pass it to the controller, telling you the name of the company.
3. Carry out the deletion as soon as the controller instructs us to, at no charge to them.

If the controller does not respond, we tell you, so that you can go to them directly or to the Superintendency of Industry and Commerce.

Acknowledgement and reference number

Within two (2) business days we reply with a reference number in the format NOV-DEL-YYYYMMDD-XXX. Keep it: with that number you can ask where your request stands at any time, at the same address.

Deadlines

A deletion request is a claim under article 15 of Law 1581 of 2012, so these are the times it runs to:

If two (2) months pass after we ask for more information and it does not arrive, the request is treated as withdrawn and we close it — you are free to file it again whenever you like.

Final confirmation

When we close it we send written confirmation saying what was deleted, what was kept, and why. We do not close a request without explaining the outcome.

Where deletion applies, we remove the following from our production systems:

• Your identifying and contact details.
• The conversation history — WhatsApp, web chat, calls — including the transcribed text of your voice notes.
• The original audio of those voice notes.
• Orders, reservations and requests associated with you, except as set out in section 6.
• Your entry in our contact lists and commercial communications.

Backups

Our backups are encrypted and rotate automatically. Data deleted from production disappears from the backups within thirty (30) calendar days at most. During that window it is isolated: not queried, not used, and restored only in the event of a serious incident — in which case we repeat the deletion.

Deletion is not absolute. Article 8(e) of Law 1581 of 2012 says so expressly: it does not apply where a legal or contractual duty to keep the information exists. Specifically:

Data kept for these reasons is blocked: held to meet the obligation, not used to contact you or for any other purpose.

Deletion is not always what you need. At privacy@novieri.com you can also:

• Find out what data we hold on you and where it came from.
• Update or correct data that is incomplete or wrong.
• Withdraw the authorization you gave.
• Object to receiving commercial communications.
• Request a copy of the authorization you granted.
• File a complaint with the SIC over an alleged breach of the law.

Enquiries — finding out what we hold — run to a shorter deadline: 10 business days, extendable by 5 more.

You can go to the Superintendency of Industry and Commerce (SIC), Colombia's data protection authority:

• www.sic.gov.co, under Protección de Datos Personales
• Carrera 13 No. 27-00, Bogotá D.C.

The law requires you to exhaust the inquiry or claim process with us first, under article 16 of Law 1581 of 2012. That is why the reference number is worth keeping.

Where someone asks for their data to be deleted through Meta — WhatsApp, Facebook, Instagram — or another platform we use, we handle it by this same procedure and to the same deadlines. The answer and the reference number go to the contact address attached to the request.

Bear in mind that deleting your data from our systems does not erase whatever remains on the platform itself: messages stored on your phone, or in the WhatsApp Business app of the business you talked to, are deleted from those apps and with that business.

If we change it, we publish the new version at this same address with its effective date. Where a change significantly affects your rights, we say so through whatever channels we have before it takes effect.