Personal data protection policy

Who answers for your data

The data controller is Plano Base Arquitectos S.A.S., a company domiciled in Cali, Colombia.

• Tax ID (NIT): 901603373-9.
• Address: Calle 18 # 61-29, Cali, Valle del Cauca, Colombia.
• Email: proyectos@planobase.co
• Phone: +57 301 426 4603
• WhatsApp: +57 315 952 6281

The area responsible for handling requests, enquiries and complaints about personal data is the Project Management Office (Dirección de Proyectos), which carries out the data protection function within the studio. Its contact channel is proyectos@planobase.co.

What data we collect

Only what you write. The site does not buy databases and does not take data from third parties.

• First and last name.
• Email address.
• WhatsApp number.
• The municipality where your project is located and the stage it is at.
• Whatever you write in the message field about your project.

We do not ask for sensitive data within the meaning of article 5 of Ley 1581 de 2012, that is, data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership of trade unions or of social or human rights organisations, data concerning health, sexual life, and biometric data. Please do not include any of it in the free-text message. If such data does reach our form, we delete it without using it for any purpose.

Along with the form submission we store a cryptographic fingerprint of your IP address, not the address itself. It serves only to limit automated submissions and abuse of the form. In addition, our hosting provider records IP addresses in its technical server logs for security and availability reasons, and keeps them for the short periods set by its own configuration.

Along with the form submission or the booking we also store how you reached the site: the first page you opened, the domain of the page that brought you (a search engine, for example) and, if you arrived through an ad or a campaign link, the campaign parameters of that link (source, medium, campaign, term and content). If you accept measurement in the notice, your browser keeps this data for up to thirty days; if you have not yet answered the notice, only while the site's tab is open. In both cases it only leaves your browser with the form you choose to send. If you decline measurement in the notice, it is not kept from one page to the next.

If you arrive from a Google Ads ad, we also store the click identifier that Google adds to the link, to measure which ad brought your enquiry. It goes with the form even if you have not answered the measurement notice, and in that case it is kept only while the site's tab is open. If you decline measurement in the notice, the identifier is neither stored nor sent.

The email signature app at apps.planobase.co has its own data policy, which supplements this one and explains what it stores if you choose to save your signature or subscribe to our publications: apps.planobase.co/en/email-signature-privacy.

The studio's social media app, which we use to publish on our Instagram, Facebook, Threads, TikTok, LinkedIn and X accounts, also has its own policy, which supplements this one and explains what data it receives from those platforms and how to have them deleted: planobase.co/en/app-de-redes/privacidad.

What we use them for

• To answer your enquiry and, where appropriate, book a consultation.
• To prepare and send you proposals, quotes and project documents.
• To stay in touch during the project and to perform the contract if we end up signing one.
• To send you commercial communications from Plano Base Arquitectos S.A.S. about our own services, which you can unsubscribe from at any time.
• To measure how effective our digital advertising is and to understand which adverts bring visitors to the site, on the terms set out in the «Measurement and advertising» section.
• To count visits to each page and measure how fast the site loads, using aggregate figures that do not identify you, so we know which content is read and can fix what loads slowly.
• To show you advertising for our own services on Meta's and Google's platforms based on your visit to the site, if you accept it in the measurement notice.
• To comply with legal, accounting and tax obligations.

We do not sell our databases and we do not hand them over to third parties for them to use for their own marketing purposes. We do not send you advertising from other companies. If we ever wanted to use your data for a purpose other than those listed above, we would ask you for fresh authorisation first.

Your authorisation

Processing requires your prior, express and informed authorisation. You give it by ticking the corresponding box, which is never pre-ticked, before submitting the form.

We keep a record of that authorisation alongside the record of your message. It includes the date and time of the submission, the exact wording of the box you ticked and the version number of this policy in force at that moment, so that what you consented to can always be established exactly.

Authorisation is voluntary. You can withdraw it at any time, in whole or in part, by writing to proyectos@planobase.co, at no cost to you. We handle withdrawals within fifteen business days.

Your rights

As the data subject, article 8 of Ley 1581 de 2012 grants you these rights:

• To know, update and rectify your personal data, in particular data that is partial, inaccurate, incomplete, fragmented, misleading, or whose processing was not authorised.
• To request proof of the authorisation you gave us.
• To be informed, on request, of the use we have made of your data.
• To lodge complaints with the Superintendencia de Industria y Comercio (Colombia’s data protection authority) for breaches of the law.
• To withdraw your authorisation or request deletion of your data where the processing does not respect constitutional and statutory principles, rights and guarantees, and also where the Superintendencia de Industria y Comercio has determined that we engaged in conduct contrary to the law. Deletion and withdrawal do not apply to data you are under a legal or contractual duty to keep in the database.
• To access your processed personal data free of charge.

How to exercise them

Write to proyectos@planobase.co stating your name, the data concerned and what you are asking for. No particular form and no intermediary is needed. Besides the data subject, these rights may be exercised by their successors in title, their legal representative and anyone holding a power of attorney, on evidence of that capacity.

Before answering we take reasonable steps to verify that whoever is writing is indeed the data subject or their representative. That check is not an obstacle: it is what stops a third party from obtaining or erasing your data by passing themselves off as you.

Enquiries are handled within ten business days. If it were not possible to resolve one within that period, we will tell you why and give you the date on which it will be dealt with, which will be no more than five business days later.

Complaints are handled within fifteen business days counted from the day after receipt. If a complaint arrives incomplete, we will ask you to complete it within the following five days; if two months pass without a reply from you, it will be taken as withdrawn. If it were not possible to resolve within the fifteen business days, we will tell you why and give you the new date, which will be no more than eight business days later.

Once the complete complaint is received, within the following two business days we add the legend «reclamo en trámite» (complaint in progress) to the database along with its subject matter, and keep it there until the complaint is resolved. If the complaint is not ours to answer, we pass it to whoever is competent within the following two business days and let you know.

Before lodging a complaint with the Superintendencia de Industria y Comercio, the law requires you to exhaust the enquiry or complaint procedure with us first. We say so because it saves you a step, not to put up a barrier.

How long we keep them

Not all data is kept for the same time, because not all of it answers the same need. Two periods apply:

• If you wrote to us or booked an appointment and we never came to a contract: twelve months from the last activity, that is, from your last message, call, appointment or quotation, or from the last step we took on your request. An appointment counts from its date or from its last change, never before it takes place. If you write to us again within that period, the period starts over. Once it is over, your data is irreversibly anonymised.
• If we did work together: for as long as our relationship with you lasts and, after that, for as long as our legal, accounting and contractual obligations require.

Anonymising means that your name, email address, phone number, message, the address of the plot, our notes about our conversations and the documents of any quotations you did not accept are deleted. We keep the date, the city, the channel through which you reached us, the type of project, the status of the request and the amounts: data that no longer identifies you and that we use only to know which services and which campaigns work. Anonymisation runs automatically once a month, also covers appointments booked on the site and is logged (when and how many requests, with no data about the people). Emails received at the ideas@planobase.co inbox are deleted in full twelve months after they arrive.

Backups of the database are encrypted and kept for twelve weeks. Anonymised or deleted data also disappears from them within twelve weeks at the latest.

And at any time, if you ask, we delete them, also if you are or were a client. Just write to proyectos@planobase.co, as explained in «How to exercise them». The only exception is whatever a legal duty requires us to keep, and in that case we tell you which duty it is and how far it extends. If you wrote to us and we never worked together, there is no such duty: the data is deleted, and that is that.

Who else sees them

We use service providers that process the data on our behalf, following our instructions and without using it for their own purposes. They are:

• Site hosting and measurement of visits and speed: Vercel Inc., processing in the United States.
• Database where form messages are stored: Supabase Inc., processing in the United States.
• Transactional email delivery, that is, the automated emails that confirm or answer your request: Resend, Inc., processing in the United States.

Apart from these providers and what is set out in the «Measurement and advertising» section, your data does not leave the studio, except at the request of a competent authority acting within its statutory powers.

The city suggestions in the form come from GeoNames (geonames.org), under a CC BY 4.0 licence.

Sending data outside Colombia

The providers listed above process the information in the United States. If you write to us over WhatsApp, that channel is operated by Meta Platforms, which also processes the information outside Colombia. The two tools in the «Measurement and advertising» section, the Meta pixel and Google Analytics, also process the information in the United States.

The Superintendencia de Industria y Comercio included the United States among the countries offering an adequate level of personal data protection, through Circular Externa 005 de 2017. By authorising the processing you also authorise, expressly and on an informed basis, that your data be sent to and processed in those countries for the purposes described in this policy.

Measurement and advertising

The site uses two third-party tools to find out which adverts bring visitors, to measure how effective our digital advertising is and to show you our adverts: the Meta Platforms pixel and Google Analytics, from Google LLC.

Both record the pages you visit, your type of device and browser, your approximate location and what you do on the site: sending the contact form, booking an appointment or opening WhatsApp. When you send the form they also receive the municipality of your project and the stage it is at, and when you book, the service you chose. They do not receive the content of your message.

When you send the form or book an appointment, we also send Meta, from our server, your email address, your phone number and your first name, together with your IP address, your browser details and the identifiers the pixel stores in it. Your email, phone and name are sent transformed by a cryptographic hash function: Meta does not receive them in readable form, but it can compare them with its own users' data to find out whether you saw one of our adverts. This is what lets us know which advert brought each enquiry even if your browser blocks the pixel.

In Google Analytics we also have three features switched on that extend what Google receives:

• Google signals. If you are signed in to a Google account and have allowed it in that account's settings, Google links your visit to the information it already holds about that account.
• User-provided data. The Google tag can detect the email address and phone number you type into the site's forms and send them to Google transformed by a hash function, to improve measurement.
• Ad personalisation. The audiences and conversions recorded by Google Analytics can be used in our Google Ads accounts to show you our adverts.

Unlike the providers in the previous section, Meta does not act on our instructions: it also processes the information it collects for its own purposes, as an independent controller, under its own policies. Google does the same with the Google signals and advertising information; it processes the rest of the measurement on our behalf. In both cases, that may include showing you our advertising on their platforms.

The Meta pixel is only switched on if you accept it in the notice that appears the first time you visit the site. If you do not accept, the site works just the same and the pixel does not load. That includes sending from our server: without your acceptance, we send nothing to Meta. Google Analytics always loads, but until you accept it works without cookies: it stores nothing in your browser and reads no identifiers from it, and sends Google only cookieless measurements (for example, that a page was opened), which Google uses to estimate ad results in aggregate. If you accept, Google Analytics also uses cookies. You can change your mind whenever you want from the link in the footer.

Apart from those two, Vercel, which hosts the site, counts visits to each page and measures how fast it loads, with its Web Analytics and Speed Insights tools, on our behalf and following our instructions. They use no cookies and store nothing in your browser, they do not receive what you type into the forms and they do not allow us to recognise you: we see aggregate figures, such as how many people viewed a page or how long it took to load. That is why they work without the measurement notice.

How we protect them

We apply reasonable technical, human and administrative measures to protect your data against loss, unauthorised access, misuse or alteration, in compliance with the security principle of Ley 1581 de 2012.

• All information travels encrypted between your browser and the site.
• Access to the database is restricted to named credentials held by studio staff who need them for their work.
• Providers that process data on our behalf are contractually bound to maintain equivalent security measures.
• The database is backed up periodically.

No security measure is absolute. Should a breach of our security codes affecting your data occur, we will report it to the Superintendencia de Industria y Comercio, in accordance with article 17 of Ley 1581 de 2012, and we will tell you about it where the incident warrants it.

Minors

This site and its forms are not directed at minors and we do not deliberately collect personal data from minors. Processing the data of children and adolescents is prohibited by article 7 of Ley 1581 de 2012, save in the cases that statute and its implementing regulation allow.

If we find that we have received a minor’s data, we delete it without using it. If you are a parent or legal guardian and believe a minor in your care gave us data, write to proyectos@planobase.co and we will delete it.

Changes to this policy

If we change this policy, we will publish the new version here with its number and its effective date. Where the change affects the purpose of the processing, the identity of the controller or the way you exercise your rights, we will tell you before applying it, through the contact channel you gave us, and ask for your authorisation again if needed.

Term

• Effective date of this version: 12 October 2026. Version 1.4. Previous versions: 1.0 (in force from 13 September 2026), 1.1 (of 25 September 2026), 1.2 (of 30 September 2026) and 1.3 (of 10 October 2026).
• Term of the database: the contact and client database will remain in force for as long as Plano Base Arquitectos S.A.S. carries on its corporate purpose, without prejudice to the individual retention periods set out in the «How long we keep them» section, which apply item by item.