Personal data processing policy

Data controller

Data controller

BRAND CONCESIONARIO S.A.S.

Address:

Cra. 69 # 98-34, Bogotá, Colombia

Phone:

+57 312 3038002

Email:

brand.cia.automotriz@gmail.com

What data we process and why

We process your name, ID number, phone, email, city, vehicle data (plate, type, photos and documents), the financial data you give us in a credit application and browsing data from this site, for these purposes:

• Handling your request: inspection and certificate, appointments, buying, selling, trade-in or financing a vehicle.
• Sending you the inspection report of a car in our inventory and contacting you about that car: price, availability, visit, financing or trade-in.
• Contacting you by phone, WhatsApp or email about your request and sending you appointment reminders.
• Sending you the car or price-drop alerts you ask for, and satisfaction surveys after an appointment or a purchase.
• Checking official vehicle sources (RUNT, SIMIT, Fasecolda) during an inspection you request.
• Sending you information about our services; you can ask us to stop at any time.
• Reviewing your credit application with our partner lenders, only when you submit one.
• Measuring site usage and the performance of our ads, only if you accept measurement cookies.
• Meeting legal, accounting and security obligations, and keeping a service history.

Answering questions about sensitive data or about children and adolescents is optional: you are not required to answer them. We do not sell your data or share it with third parties outside the purposes above.

Your rights (art. 8, Law 1581 of 2012)

• Know, update and correct your personal data.
• Request proof of the authorization you gave us.
• Be told, on request, how we have used your data.
• File complaints with the Superintendencia de Industria y Comercio for breaches of the law.
• Revoke the authorization and/or request deletion of your data when legal principles, rights and guarantees are not respected.
• Access your personal data free of charge.

Inquiries and claims (arts. 14 and 15)

You, your successors or your representative can file inquiries and claims through the contact details above or at our location.

Inquiries: we answer within ten (10) business days of receipt at most. If that is not possible, we tell you why and the new date, no more than five (5) additional business days.

Claims (correction, update, deletion or breach): include your identification, a description of the facts, your address and any supporting documents. If the claim is incomplete, we ask you to correct it within five (5) business days of receiving it; if two (2) months pass from that request without you providing the information, the claim is considered withdrawn. We resolve it within fifteen (15) business days from the day after receipt at most; if that is not possible, we tell you why and the new date, no more than eight (8) additional business days.

Before going to the Superintendencia de Industria y Comercio you must first complete this inquiry or claim process with us (art. 16).

How we ask for and keep your authorization

Before collecting your data we ask for your prior, express and informed authorization, through a box you must tick yourself. We store the date, the version of this policy you accepted and the IP address you gave it from, so we can prove it whenever you ask (art. 9 of Law 1581 and art. 7 of Decree 1377).

Who we share your data with

We only share your data with providers that help us deliver the service and act as data processors, following our instructions:

• Hosting and backup services for the platform.
• Email and WhatsApp delivery (for example, appointment confirmations and reminders).
• The payment gateway, when you pay for an inspection online.
• Measurement and advertising tools (Google and Meta), only if you accept those cookies.
• Meta (Instagram and Facebook) and Google custom audiences, only with people who agreed to receive BRAND news.
• Partner lenders, only when you submit a credit application.
• Authorities, when a law or a court order requires it.

Some of these providers store information on servers outside Colombia, including the United States. We only work with providers that offer adequate protection and require them to use your data solely to provide their service to us. Customer data from our Miami location is processed under this same policy.

Security of your data

We protect your data with role-based access for each team member, encrypted passwords, secure connections (HTTPS), daily backups and an activity log. No system is infallible: if an incident affects your data, we will report it to the Superintendence of Industry and Commerce and to you when required.

How long we keep your data

For as long as our relationship and the purpose you gave it for last, and afterwards for the time accounting, tax and commercial rules require. Inspection report requests are deleted automatically after two (2) years. Other contact data is deleted when it is no longer needed for the purposes of this policy or when you ask us to delete it.

Children and teenagers

Our services are for adults. We do not knowingly collect data from anyone under 18; if we learn we did, we delete it.

Who handles your requests

The management of BRAND CONCESIONARIO S.A.S. handles inquiries, complaints and requests to update, correct or delete data, through the contact channels listed above.