Personal data processing policy

Updated in July 2026. Download the document in PDF.

Who answers for your data

Two companies answer for it: WG CONSULTORES SST SAS, with tax ID (NIT) 900.272.469-1, and WAY BROKERS LTDA, with tax ID (NIT) 900.272.378-1. Both have their principal address in Medellín and both are listed as data controllers.

Address for filings: Carrera 43 B N. 16-41, office 1504, STAFF building, Medellín. Email: pqrs@waygroupsa.com. Telephone: +57 4 3220622.

What the policy covers

It applies to every personal database held by the WayGroup companies and to those handled by the processors acting on their behalf. It covers any data recorded in a database in a form that makes it capable of being processed, except public information.

The framework is Statutory Law 1581 of 2012 and its implementing decrees. The right of habeas data is the right every person has to know, update and correct the information collected about them.

The eight principles

Processing is governed by eight principles: lawfulness, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality.

Two practical consequences. Processing takes place only with the data subject's prior, express and informed consent. And personal data, other than public data, cannot be left available on the internet without a technical control that restricts who can see it.

What information is collected

Information that identifies the data subject: name, the company they work for, home address, identification number, telephone, email, education, work experience, IP address and personal interests, among others.

Information may also be collected from public databases and from third parties the data subject has authorized to share it. Those sources supply name, age, address, telephone and job title, among others.

What they are used for

The policy lists the purposes one by one. Among them: keeping in touch about services, programs, campaigns and content; classifying, comparing and verifying the information provided; preparing market and statistical studies; and meeting the legal reporting obligations owed to the competent authorities.

Activity on the website is also recorded for statistical purposes: pages visited, time spent, links followed, search terms, IP address, browser type and times of access.

WayGroup states that it does not disclose personal information to third parties for marketing or advertising without express consent. The document makes clear that this consent is taken as given by accepting the terms of the policy when registering on the site.

Sensitive data and minors

The data subject has the right not to provide sensitive data. Sensitive data are those revealing racial or ethnic origin, sex life, health, religious or philosophical belief and political views, plus biometric data: photographs, fingerprints, signatures, voice, movement. The document recommends not sending sensitive information that is not needed to deliver the service.

Providing data about minors is optional and requires authorization from a parent or legal guardian. None of the services WayGroup offers is aimed at minors.

The data subject's rights

To know, update and correct their data, including with anyone who has received it by transfer. To request proof of the authorization given, except where the law waives that requirement. To be informed, on request, of the use made of the data.

To withdraw the authorization and request deletion of the data where processing does not respect the legal principles, rights and guarantees. To access the processed data free of charge. To ask about retention and deletion periods.

To complain to the Superintendency of Industry and Commerce about breaches of the personal data protection regime.

How to file a query or a complaint

The Administrative Department handles this in both companies. Telephone 3002747873 and email pqrs@waygroupsa.com. Filings can also be made at the Medellín address or through the website.

You must attach a copy of your identity document: national ID card, youth ID card, foreigner's ID card or passport. Someone acting as a successor must also provide the data subject's death certificate and the document proving the capacity in which they act. A legal representative or attorney-in-fact must provide the power of attorney and the data subject's document number.

A query is answered within ten business days of filing. Where that is not possible, the reasons for the delay and the new date are given, and that date cannot be more than five business days after the first deadline expires.

A complaint is answered within fifteen business days counted from the day after receipt, extendable by a maximum of eight business days. If the request arrives incomplete, the data subject is asked to complete it within the following five business days; if two months pass with no reply, the request is treated as withdrawn. Once the complete request is received, the database is flagged as a claim under review within a maximum of two business days.

Information security

Access to personal data is restricted by privilege and password to the employees, contractors, representatives and agents who need it to do their job.

The policy asks five things of the data subject: do not create accounts for other people without their authorization, do not share your username and password, do not let third parties into your account, do not send unnecessary information or third-party information without authorization, and do not provide false or out-of-date information.

WayGroup states that it registers its databases with the National Registry of Databases, the public directory run by the Superintendency of Industry and Commerce.

Term

Databases are kept for as long as the purpose their processing was authorized for requires. Where there is no such purpose, twenty years.

The policy has been in force since October 26, 2016 and supersedes any special rules or manuals adopted before it. Any substantial change is communicated to data subjects through the usual contact channels.

The binding document is the PDF

This page summarizes the policy so it can be read quickly and linked section by section. It does not replace it. The binding text is the twelve pages of the signed PDF, which can be downloaded from here.

Where this summary and the PDF disagree, the PDF prevails.