Personal Data Processing Policy

Last updated: to be defined once the document is approved.

This is an English translation for reference only. The Spanish version of this policy governs and prevails in case of any discrepancy.

1. Data controller

Aburrá Motors, domiciled in Medellín, Antioquia, Colombia, is the controller responsible for processing the personal data collected through this website and its associated contact channels.

Pending completion: exact legal name, tax ID (NIT), address for judicial notifications, and the email address enabled for data subjects to exercise their rights.

Current contact channels: contacto@aburramotors.com and WhatsApp +57 311 389 0806.

2. Data we collect

Through the site’s forms and WhatsApp conversations we may collect:

• Full name.
• Mobile number and email address.
• Municipality of residence.
• Information about the vehicle you’re interested in or the vehicle you want to sell: make, model, year, mileage, license plate, and general condition.
• Loan simulation data: price, down payment, term, and approximate income when you choose to provide it.
• Technical browsing data associated with the origin of the request.

We do not request sensitive data as defined in Article 5 of Law 1581 of 2012. We also do not request passwords, banking PINs, or full card numbers through this channel.

3. Purposes of processing

• Attend to and respond to the requests you send us.
• Prepare appraisals, insurance quotes, and vehicle loan applications.
• Manage the purchase, sale, consignment, trade-in, and transit paperwork of the vehicle.
• Share strictly necessary information with financial institutions, insurers, and transit authorities to carry out the service you requested.
• Inform you of the status of your process through the channels you authorized.
• Send you commercial information about vehicles and services, provided you have authorized it and until you request otherwise.
• Prepare aggregated internal statistics to improve the service.

4. Data subject’s authorization

By checking the authorization box on any of the site’s forms, or by sending us your data over WhatsApp for the same purpose, you grant prior, express, and informed authorization for the processing of your personal data under the terms of this policy.

5. Data subject’s rights

Under Article 8 of Law 1581 of 2012, as a data subject you have the right to:

• Know, update, and correct your personal data with us.
• Request proof of the authorization granted, except where the law does not require it.
• Be informed, upon request, of the use given to your personal data.
• File complaints with the Superintendency of Industry and Commerce (SIC) for violations of the law.
• Revoke the authorization or request the deletion of your data when no legal or contractual obligation prevents it.
• Access your personal data free of charge.

6. How to exercise your rights

You can exercise these rights by writing to contacto@aburramotors.com with the subject line “Protección de datos personales” (Personal data protection), stating your full name, ID number, your specific request, and a channel for our response.

Inquiries are handled within a maximum of ten (10) business days, extendable by five (5) more. Complaints are handled within a maximum of fifteen (15) business days, extendable by eight (8) more, under Articles 14 and 15 of Law 1581 of 2012.

7. Retention period

Data is retained for as long as an active business relationship exists and, after it ends, for as long as required by applicable legal, accounting, and tax obligations. After that period, it is deleted or anonymized.

8. Information security

We adopt reasonable technical, human, and administrative measures to protect data against unauthorized access, loss, or misuse. No measure eliminates risk entirely, so we ask that you not send us information through these channels that isn’t necessary for the service.

9. Changes to this policy

We may update this policy. Any substantial change will be published on this same page along with its update date.