Personal Data Processing Policy (B2B)
This policy explains how MarkenGroup S.A.S. collects, uses, stores, shares and protects personal data in connection with services primarily offered to entrepreneurs and organizations (B2B).
1. Data Controller (Responsible Party)
- Controller: MarkenGroup S.A.S.
- NIT: 902003798-4
- Address: Calle 5 SUR #25-233, Medellín, Colombia
- Privacy email: [email protected]
- Internal responsible person: Ludger Pütz
2. Scope and legal framework (Colombia)
Processing is carried out under Colombian data protection law, especially Law 1581 of 2012 and its implementing regulations (including Decree 1377 of 2013). Where applicable, RNBD (SIC) related obligations will be met.
3. Personal data we may collect
3.1 Website visitors (analytics and security)
- IP address, browser, device, operating system, approximate location
- Usage data: pages, clicks, scroll, time on site, events and conversions
- Technical and security logs
3.2 Contact form / business inquiry (B2B)
- Name, email, phone number
- Company and website URL
- Message content and any data voluntarily provided
3.3 Client application / commercial qualification
- Business/operational information (e.g., revenue and other business data)
- Data voluntarily provided to assess fit and needs
3.4 Jobs platform / candidates (Talent Pool)
- Identification and contact data (including date of birth)
- Resume/CV, employment and education history
- Photos (if provided), social profiles, portfolio or LinkedIn links
- Salary expectations and self-assessed skills
- Any additional information included in open fields or documents
3.5 Clients and leads
- Communication history from CRM, email, WhatsApp and our proposal portal
- Proposals, quotes and contract-related data
- Sending, delivery, opening and interaction data from TrackMailer where legally permitted
- Measurement, campaign and attribution data from TrackAny.Click
- Data necessary for legal and/or contractual obligations
3.6 Processing with artificial intelligence
Data may be processed by AI-assisted systems to handle inquiries, create and improve content, analyze documents and data, automate workflows and provide agreed features. This may include prompts, uploaded content, metadata and generated results. We limit the data transferred to the relevant purpose and use human review and contractual safeguards where appropriate. Decisions with legal or similarly significant effects are not made solely by automated means unless separately disclosed and legally permitted.
4. Purposes of processing
- Contact and communication
- Managing contacts, leads and customer relationships in a CRM
- Communication by email and WhatsApp and the sending and analysis of transactional or consented messages through TrackMailer
- Preparing offers and managing contractual relationships
- Marketing and retargeting (depending on consent configuration)
- Web analytics and optimization
- Measuring and attributing campaigns and conversions with TrackAny.Click
- AI-assisted analysis, automation, content creation and provision of agreed features
- Security and fraud prevention
- Recruiting and Talent Pool management
- Compliance with legal obligations
5. Consent and collection methods
Where legally required, processing is carried out based on prior, explicit and informed consent. We use a cookie/tracking banner and checkboxes in contact and candidate forms to manage authorizations.
6. Tools, platforms and third parties
- Microsoft Clarity (usage analytics, session recordings and heatmaps, only in accordance with consent settings)
- Google Analytics (web analytics, events, conversions and technical measurement data, only in accordance with consent settings)
- Google Cloud and Firebase (hosting, databases, authentication, storage, functions, logging and technical infrastructure)
- TrackAny.Click (first-party measurement, campaign attribution, conversion and advertising-account data according to the relevant configuration and consent)
- TrackMailer (email delivery and delivery, opening and interaction measurement where legally permitted)
- CRM, email and WhatsApp services (contact management, communication, support, proposals and contract administration)
- AI service providers (analysis, automation, content creation and agreed AI features, depending on the engagement and configuration)
- Cloudflare (CDN, security, DNS/WAF, optimization and logs)
- Meta Pixel and Conversions API (CAPI) (measurement/remarketing subject to consent)
- LinkedIn (API/Insight/measurement subject to consent)
- Amazon Web Services – AWS (cloud infrastructure, storage, servers and email delivery, e.g., SES)
We also maintain social media accounts on Facebook, X (Twitter), Instagram and LinkedIn. When you interact with those platforms, their own privacy policies apply as well.
7. International data transfers
Some of these technologies – particularly Microsoft, Google, Meta, LinkedIn, AWS, communications, CRM and AI providers – may process data outside Colombia. Depending on the service, processing locations may include the United States, the European Union or other countries. We use these services under applicable data-protection rules and, where required and available, use data-processing agreements, standard contractual clauses or comparable contractual safeguards.
8. Security measures
We implement reasonable technical, administrative and organizational measures to protect personal data. However, no system can be guaranteed 100% secure.
9. Retention periods
- Candidates (Talent Pool): up to 3 months; we may request renewal afterward. Deletion can be requested at any time.
- Contact inquiries: up to 3 months; if a contract exists, for the contract term and as needed for legal/support purposes.
- CRM, contract, invoice and communications data: for the duration of the business relationship and afterward as required by statutory retention and evidentiary duties.
- TrackMailer, TrackAny.Click and AI processing data: according to the purpose, product configuration, contract and legal duties; data is deleted or anonymized when no longer required for those purposes.
- Analytics (tracking) data: up to 24 months.
- Logs and security: up to 24 months.
10. Data subject rights and contact
Data subjects may request access, updating, correction and deletion of their data, and revoke consent where applicable. Contact: [email protected].
- Inquiries (Consultas): generally up to 10 business days (with notice if extended).
- Complaints/claims (Reclamos): generally up to 15 business days (with notice if extended).
11. Not directed to minors
Our services and content are not directed to minors.
12. Policy updates
We may update this policy due to legal, technical or operational changes. The current version will be published on the website.