Privacy Policy and Personal Data Processing

The processing of personal data within this website, the Platform and the Services is governed by Law 1581 of 2012 (Personal Data Protection Law), Decree 1377 of 2013 and other applicable regulations in force in Colombia.

MORFX S.A.S., in its capacity as Data Controller, collects and processes the following personal data of Administrator Users of Client Companies:

With respect to the personal data of the End Consumers of the Client Company that are processed through the Platform, MORFX S.A.S. acts in its capacity as Data Processor, following exclusively the instructions of the Client Company, which is the Data Controller with respect to such consumers. MORFX S.A.S. will not determine the purposes of processing of such data and will not use them for its own purposes other than the provision of the Services.

In its capacity as Data Controller of the data of its End Consumers, the Client Company undertakes to:

The MORFX S.A.S. Conversational Agent shall implement the following informed consent mechanism in each interaction with an End Consumer:

Before starting the conversation, the Agent may indicate to the End Consumer: (a) the hyperlink where they can consult the Data Controller's (Client Company's) personal data processing policy, which must include the identity of the Controller, purposes of processing, rights of the data subject, and channel to exercise them; and (b) that by continuing the conversation, they authorize the processing of their personal data for the informed purposes.

The Client Company is responsible for keeping evidence of the consent granted by its End Consumers.

For the provision of the Services, MORFX S.A.S. may transmit personal data of End Consumers to the following sub-processors:

Data subjects whose personal data are processed by MORFX S.A.S. in its capacity as Data Controller (Administrator Users) have the following rights, exercisable under the terms of Law 1581 of 2012 (ARCO: Access, Rectification, Cancellation, Objection):

MORFX S.A.S. will retain the personal data of Administrator Users during the term of the Services Agreement and for the additional period necessary to comply with legal and contractual obligations. Personal data of End Consumers processed as Data Processor will be returned or securely deleted within a maximum period of thirty (30) calendar days after termination of the Agreement, at the Client Company's election.

In the event of a security incident affecting personal data, MORFX S.A.S. shall notify the Client Company within no more than seventy-two (72) hours from knowledge of the fact, and will cooperate with the Client Company to comply with notification duties to the SIC and affected data subjects in accordance with current regulations.

When entering the website for the first time, the user may find a notice (cookie banner) that allows them to accept or reject the non-essential cookie categories. The user may at any time manage or revoke their cookie preferences through their browser configuration or the preferences panel available on the website. The revocation of consent for non-essential cookies will not affect the functionality of strictly necessary cookies nor the provision of the contracted Services.

Where applicable, session cookies are deleted when the browser is closed. Persistent cookies have a maximum duration of twelve (12) months, unless otherwise indicated in the description of each cookie.