Data Deletion Instructions

GDPR Article 12(1) requires information of this kind to be given "in a concise, transparent, intelligible and easily accessible form, using clear and plain language". We have tried to do that rather than hide the procedure inside legal boilerplate. If any part of this page is unclear, write to us and we will explain it.

This split is not a way of passing you from one door to another. It is how the law allocates responsibility, and it is set out in more detail in section 7 of our Privacy Policy. Whichever route applies to you, we commit to answering — including when the answer is that another party has to make the decision, in which case we will tell you who they are and how to reach them.

Colombian Law 1581 of 2012 gives you an equivalent and in some respects broader set of rights — the derechos ARCO: to know, update and rectify your data; to ask for proof of the authorization you gave; to be told how your data has been used; to complain to the Superintendencia de Industria y Comercio; to revoke your authorization and request suppression; and to access your data free of charge. The Spanish version of this page quotes article 8 of that law in full, and article 9 adds the right to withdraw the authorization you granted.

Withdrawing consent and deleting data are not the same request. If what you actually want is for the messages to stop, say so — we or the business will stop contacting you, which is faster and leaves your history intact.

Deletion is irreversible. Once a conversation history is erased we cannot restore it, and neither can the business you were talking to. If you may need a record of what was agreed — an order, a quote, an appointment — save it before you ask.

Email morfx.colombia@gmail.com from the address registered on your MorfX account, with the subject line "Data deletion request". Writing from the registered address is itself the first layer of identity verification, which is why we ask for it.

Include the following, so that we can find the right records and act on them without ambiguity:

We reply within two business days to confirm that the request arrived. If we have reasonable doubts about who is asking — for instance, the request comes from an address that is not the registered one — GDPR Article 12(6) permits us to request additional information to confirm your identity, and we will. We do not delete anything on an unverified first message.

If your workspace has other administrators, deleting the whole workspace also removes their access and the end-consumer data your business keeps there. We will point this out before proceeding and ask you to confirm a second time.

Deletion completes within 30 days of a verified request. We then send you written confirmation setting out what was erased, what was retained under section 9 and on what legal basis, and the date on which the retained data becomes deletable.

Contact the business directly, through the same channel you used to talk to it or through the contact details on its website, and ask it to delete your personal data. The business obtained your authorization, it decides the purposes, and it can instruct us to erase your record. Under Colombian law this step is also a precondition for escalating to the regulator — see section 11.

If you cannot identify or reach the business, or it does not answer within the deadlines in section 8, write to us on WhatsApp at +57 313 754 9286, or by email to morfx.colombia@gmail.com with the subject "Data deletion request". Include:

We match the phone number or account you write from against the conversation records, and we check the details you give us — the business, the approximate date of the last interaction — against what we hold. If they do not line up, we will ask you for more information rather than delete someone else's data by mistake.

As the business's data processor, we notify it that you have requested erasure and we coordinate the deletion with it. We confirm receipt to you within two business days and tell you the outcome within the applicable deadline in section 8. If the business instructs us not to delete, we will say so plainly and give you its contact details so you can pursue the matter with the controller, or escalate as described in section 11.

Because this data is not tied to an account, an exact match is not always possible. We will delete everything we can attribute to you, and we will tell you honestly if we cannot isolate a record rather than claim a deletion we did not perform. Deletion completes within 30 days.

Three things. We delete everything that the exception does not cover. We tell you exactly what we kept and on what legal basis. And we tell you the date on which the retained data becomes deletable, so the retention has a visible end.

Retained data stays restricted to the purpose that justified keeping it. We do not carry on using it for anything else — no messaging, no analytics, no model training.

Some of these providers are themselves controllers of the data you gave them through their own channels. Meta in particular holds your WhatsApp, Messenger or Instagram messages under its own terms: deleting your record with us does not delete your account or your message history with Meta, and for that you have to use Meta's own tools. We will point you to them if you ask.

Where erasure at a sub-processor is technically impossible or would involve disproportionate effort — for example, data already absorbed into a provider's aggregated, non-identifying operational logs — we will tell you so and explain what we did instead. We would rather report the limit than imply a deletion that did not happen.

If you want the full, current list of the recipients to whom your specific data was disclosed, ask us and we will provide it.

You may also lodge a complaint with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement, as GDPR Article 77 provides. Doing so does not require you to go through the SIC first.