Data processing policy
This policy is written for Colombia's data protection law, Law 1581 of 2012, and its Decree 1377 of 2013, and for Ecuador's Organic Law on Personal Data Protection. It covers the people I write to about my services and my clients. What happens on this website is also covered by the privacy policy.
This is a translation. The Spanish version at andresbrinez.com/politica-de-datos is the one that governs. In force since 15 October 2026.
Andrés Camilo Briñez Núñez, an individual, domiciled at Boulevard Naciones Unidas, Quito, Ecuador, and registered with Colombia's tax register (RUT). Email: contacto@andresbrinez.com. Phone and WhatsApp: +593 95 893 3406. Website: andresbrinez.com.
I handle every query and complaint about your data myself.
If I wrote to you about my services: your name, your role, the firm or company you work for, your work email and phone, your city and website. I take them from public sources: Colombia's commercial register, the firm's website and the professional profiles you published, such as LinkedIn. I also keep what we discussed.
If you write to me: what you tell me and your contact details. Downloading the exógena checker or any other tool on this site asks for no data at all.
If you are a client: the details needed to fulfil the contract and invoice you.
I process no sensitive data and no data about children or adolescents. A company's own data, such as its legal name, its tax ID or the firm's general email address, is not personal data; I look after it the same way.
To write to you about what I do, such as the exógena done and reconciled or free tools such as the checker, and to follow up on that conversation. I write rarely, and I stop as soon as you ask.
To answer your messages, prepare proposals, fulfil contracts, invoice and meet my accounting and tax obligations.
To keep a do-not-contact list, so that I never write again to anyone who asked me not to.
I do not sell, rent or hand over your data, and I do not use it for anyone else's advertising.
The data I take from Colombia's commercial register is public by law (Commercial Code, art. 26), and Law 1581 does not require consent to process data of a public nature (art. 10, b). I follow its rules all the same: I tell you where your data came from and why I am writing, and I delete it if you ask.
When data is not public, I process it with your consent, which you can give in writing, verbally or by unambiguous conduct, such as writing to me or replying (Decree 1377 of 2013, art. 7). With clients, the basis is the contract.
If you are in Colombia (Law 1581, art. 8): to know, update and correct your data; to ask for proof of your consent, where there is one; to know how I use it; to complain to the Superintendence of Industry and Commerce (SIC), Colombia's data protection authority; to withdraw your consent and ask me to delete your data; and to access it free of charge.
If you are in Ecuador (Organic Law on Personal Data Protection): to access, correct and update your data, to have it deleted, to object to its processing, to ask for its portability, to ask me to suspend processing it, and not to be subject to automated decisions, which I do not make. You can go to the Superintendence of Personal Data Protection.
Write to contacto@andresbrinez.com with the subject «Datos personales». Say what you are asking for and which email address or number it concerns, so I can find your data.
I answer a query, to learn what I hold about you, within ten business days at most. A complaint, to correct, update or delete your data or withdraw your consent, within fifteen business days at most. If I cannot make it, I tell you why and give you a new date beforehand, no more than five further business days for a query or eight for a complaint (Law 1581, arts. 14 and 15).
If you just want me to stop writing, reply «no» to any message of mine: I act on it the same day. To keep to it, I store only your email address and the date you asked.
A complaint to Colombia's SIC can be filed once you have made the query or complaint here (Law 1581, art. 16).
My business system runs on a server of my own in Ecuador. Others take part, each with a narrow task: Google, because my email is on Gmail; Cloudflare, which delivers the website and the mail that reaches contacto@andresbrinez.com; Resend, which sends the website's emails; and LinkedIn, if we talk there. So your data is processed in Ecuador and in the countries where those providers have their servers, mainly the United States.
The data of an accounting firm's clients, when the firm hires me for their exógena, is not covered by this policy: it is handled under a data transmission agreement with the firm, which states what I do with it, where and for how long.
For people who wrote to me or whom I wrote to, while the conversation lasts and up to two years after the last contact, unless you ask me to delete it sooner. The do-not-contact list is kept for as long as it is needed to honour it. For clients, as long as accounting and tax rules require.
Only I have access to it. It lives on my server, under my physical control, with encrypted backups, and in accounts I protect myself. If a security incident affected your data, I would tell you and report it to the relevant authority.
In force from publication. Changes are published on this page with their date, and if the purposes change I tell you before applying them. The rules: in Colombia, Law 1581 of 2012 and Decree 1377 of 2013, now compiled in Decree 1074 of 2015; in Ecuador, the Organic Law on Personal Data Protection, Official Register 459 of 26 May 2021.