Personal Data Processing Policy

This policy applies to all personal data held in the Firm's databases, however collected: the contact form on this website, emails sent to the Firm or its lawyers, telephone communications, résumés submitted by applicants, and data provided in the course of a professional relationship. It binds all partners, lawyers, employees and contractors of the Firm, as well as third parties processing data on the Firm's behalf.

• Article 15 of the Colombian Constitution — the fundamental right of habeas data.
• Law 1581 of 2012 — general personal data protection regime.
• Decree 1377 of 2013, codified in Decree 1074 of 2015 (Title 2, Chapter 25).
• Law 1266 of 2008 — financial habeas data, where applicable.
• Title V of the Sole Circular of the Superintendence of Industry and Commerce, and any rules amending or replacing the above.

• Data subject: the natural person whose personal data is processed.
• Personal data: any information linked to, or capable of being associated with, one or more identified or identifiable natural persons.
• Sensitive data: data affecting the data subject's privacy or whose misuse may lead to discrimination — including data revealing racial or ethnic origin, political orientation, religious or philosophical convictions, trade union membership, as well as health data, data concerning sex life, and biometric data.
• Data controller: the party deciding on the database and its processing. For this policy, Gamboa Abogados S.A.S.
• Data processor: the party processing personal data on the controller's behalf.
• Processing: any operation on personal data, such as its collection, storage, use, circulation or deletion.
• Authorization: the data subject's prior, express and informed consent to the processing.
• Privacy notice: the communication informing the data subject that this policy exists, how to access it, and the purposes of the processing.

The Firm applies the principles set out in article 4 of Law 1581 of 2012:

• Legality: processing is a regulated activity subject to the law.
• Purpose: processing serves the legitimate purposes disclosed in this policy.
• Freedom: processing requires the data subject's prior, express and informed consent, save where a legal or judicial mandate dispenses with it.
• Accuracy or quality: data must be truthful, complete, accurate, up to date, verifiable and comprehensible.
• Transparency: data subjects may obtain information about their data at any time and without restriction.
• Restricted access and circulation: data may be processed only by persons authorized by the data subject or by law.
• Security: information is handled with the technical, human and administrative measures needed to prevent its alteration, loss, or unauthorized access or use.
• Confidentiality: everyone involved in the processing must keep the information confidential, an obligation that survives the end of their relationship with the Firm. It is additional to — and never a substitute for — the attorney-client privilege protecting the professional relationship.

Except where the law does not require it, the Firm obtains the data subject's prior, express and informed authorization no later than at the time of collection. Authorization may be given in writing, orally, or through unequivocal conduct. Silence is never treated as authorization.

On this website's contact form, authorization is given by voluntarily ticking a box that is not pre-ticked and that links to this policy. The Firm keeps evidence of each authorization, together with the date it was given and the text the data subject accepted.

You may withdraw your authorization and request deletion of your data at any time, following the procedure below. Withdrawal does not apply where a legal or contractual duty requires the data to be kept — for instance, the retention of case files for matters entrusted to the Firm.

The Firm does not collect sensitive data through this website, and asks that you not include any in the contact form. Where the professional mandate requires processing it — health data in a tort matter, or a child's data in a family matter — the Firm informs the data subject that they are not obliged to authorize it and obtains explicit consent, except where the law dispenses with consent.

Children's data is processed only where doing so respects their paramount rights, with their legal representative's authorization and after the child has been heard.

Prospective clients and people who contact us. Data you provide by writing to us or completing the contact form is processed to receive, assess and answer your enquiry; to run a conflicts-of-interest check before accepting a matter; to prepare and send fee proposals; and to contact you for those purposes.

Clients. Within the professional relationship, data is processed to deliver and administer the legal services engaged; to carry out know-your-client and due diligence procedures, including restrictive-list screening and the prevention of money laundering and terrorist financing; to invoice, collect fees and keep the Firm's accounts; to retain case files and documentation for as long as the law and the mandate require; and to respond to requests from judicial and administrative authorities.

Third parties connected to a matter. In exercising its professional mandate, the Firm processes personal data of opposing parties, witnesses, experts, counsel and other third parties appearing in case files and matter documentation. That processing rests not on the data subject's consent but on the exercise of the right of defence, compliance with legal duties, and performance of the mandate conferred by the client, and is limited to what the matter strictly requires.

Applicants. Résumés and applicants' data are processed to assess the candidacy, run the selection process, verify the information provided, and consider the applicant for future openings.

Institutional communications. Subject to separate, specific authorization, the Firm processes contact data to send legal bulletins, regulatory updates and event invitations. This authorization is optional: declining it affects neither your enquiry nor any service, and you may withdraw it at any time by writing to notificaciones@galegal.co.

Under article 8 of Law 1581 of 2012, you may:

• Access, update and rectify your personal data held by the Firm.
• Request evidence of the authorization you granted, except where the law does not require it.
• Be informed, upon request, of how your data has been used.
• File a complaint with the Superintendence of Industry and Commerce, once the enquiry or claim procedure before the Firm has been exhausted.
• Withdraw your authorization and request deletion of your data, where no legal or contractual duty requires its retention.
• Access your data free of charge — at least once every calendar month.

The Firm assumes the duties set out in article 17 of Law 1581 of 2012: guaranteeing the full exercise of your rights; requesting and keeping a copy of the authorization; informing you of the purpose of collection; keeping the information under the necessary security conditions; handling enquiries and claims within the statutory deadlines; and using the data only for the purposes described here.

The Firm does not sell or trade personal data. It may disclose data to third parties only: to judicial, administrative and supervisory authorities, upon lawful request or where necessary to defend a client's interests in a proceeding; to technology providers acting as processors — in particular Microsoft 365 for email, storage and collaboration, and this website's hosting provider — under contractual confidentiality and security obligations; to corresponding counsel, experts or collaborating firms where the matter requires it; and to the international network of firms to which the Firm belongs, where a matter spans more than one jurisdiction and the client has authorized it.

Some of these processors are domiciled outside Colombia, so processing may involve an international transmission of data. In those cases the Firm contractually requires protection standards no lower than those of Colombian law.

The administrative area of Gamboa Abogados S.A.S. handles requests, enquiries and claims concerning personal data. It is where you may exercise your rights to access, update, rectify and delete your data and to withdraw your authorization.

• Email: notificaciones@galegal.co
• Address: Carrera 7 # 76-35, Office 501, Bogotá D.C. 110221, Colombia
• Telephone: +57 601 321 1391

Enquiries. You may ask at any time what personal data of yours we hold. Enquiries are answered within ten (10) business days of receipt. If that is not possible, we will tell you why and give a date for our answer, which will not exceed five (5) business days after the first deadline.

Claims. If you believe your data should be corrected, updated or deleted, or you detect a breach of the law, you may file a claim stating your identification, the facts, a contact address and any supporting documents. If the claim is incomplete, we will ask you to complete it within five (5) days of receipt; if you do not do so within two (2) months, the claim will be deemed withdrawn. If we are not the competent party, we will forward it within two (2) business days and let you know. We will flag the record as "claim in process" within two (2) business days, and answer the claim within fifteen (15) business days from the day after receipt — extendable, with notice, by no more than eight (8) business days.

Complaint to the Superintendence. The law requires you to exhaust the enquiry or claim procedure before the Firm first. Only then may you complain to the Superintendence of Industry and Commerce.

The Firm adopts reasonable technical, human and administrative measures to protect personal data against alteration, loss, or unauthorized or fraudulent access or use: access controls, encryption in transit for this website's communications, confidentiality obligations for all personnel, and backups.

No security measure is infallible. If an incident affects the information in our databases, the Firm will report it to the Superintendence of Industry and Commerce within fifteen (15) business days of detection, as required by Title V of its Sole Circular, and will notify affected data subjects where appropriate.

Under Decree 090 of 2018, the duty to register databases with the National Database Registry falls on companies with total assets above one hundred thousand (100,000) UVT and on public-law entities. Gamboa Abogados S.A.S. is below that threshold and is therefore not required to register. That does not relieve the Firm of any other duty under Law 1581 of 2012, including the reporting of security incidents to the Superintendence.

This website's fonts are served from our own domain and it carries no social-media pixels. Traffic is measured with two tools: Cloudflare Web Analytics, which sets no cookies, yields aggregate statistics and cannot identify a visitor; and Google Analytics, which does set cookies and profiles browsing, and therefore loads only if the visitor consents in the notice displayed on arrival. Those who decline receive no cookies and lose no functionality, and consent may be withdrawn at any time via the "Cookie preferences" link in the footer.

The one exception is the contact page, which embeds a Google Maps map showing our office location. That map loads together with the page, so Google receives your IP address and may set cookies in your browser, under its own privacy policies, which are outside the Firm's control. To avoid this, you may look up our office address without opening that page, or block third-party cookies in your browser settings.

The contact form runs on Microsoft Forms and responses are stored in the Firm's Microsoft 365 corporate environment. Our hosting provider logs technical connection data — including IP address — for security and operational purposes, as any web server does.

Gamboa Abogados serves clients established in the European Union. To the extent the processing relates to offering services to people located in the Union, Regulation (EU) 2016/679 (GDPR) applies in addition to — not instead of — Colombian Law 1581 of 2012.

Legal bases. The Firm processes such data on the basis of performance of the engagement contract or pre-contractual steps (art. 6(1)(b)); compliance with legal obligations (art. 6(1)(c)); its own or its clients' legitimate interests, including conflicts-of-interest checks and the defence of their interests (art. 6(1)(f)); and consent, for institutional communications only (art. 6(1)(a)). Where a matter requires processing special categories of data, the basis is the necessity of the processing for the establishment, exercise or defence of legal claims (art. 9(2)(f)).

International transfers. Colombia is not the subject of a European Commission adequacy decision. Transfers of personal data from the Union to the Firm rely on the Standard Contractual Clauses adopted by the Commission (art. 46(2)(c)), incorporated into engagement contracts, and, failing that, on the derogations in article 49 — in particular the necessity of the processing for the establishment, exercise or defence of legal claims (art. 49(1)(e)) and for the performance of a contract concluded in the data subject's interest (art. 49(1)(b) and (c)).

Rights. Data subjects in the European Union have the rights of access, rectification, erasure, restriction of processing, portability and objection; to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand; and to lodge a complaint with the supervisory authority of their Member State. They may exercise these rights by writing to notificaciones@galegal.co.

Automated decisions. The Firm takes no decisions based solely on automated processing that produce legal effects on data subjects or similarly significantly affect them. The only profiling occurring on the website is Google Analytics' statistical profiling, which runs only if the visitor consents and is never used to take any decision about them.

Transfers to Google. If you accept analytics cookies, your browsing data is processed by Google LLC in the United States. Those transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, to which Google adheres. If you decline cookies, none of your data is transferred to Google.

This policy takes effect on July 14, 2026. The Firm's databases remain in force for as long as the purposes described here subsist, together with the legal and contractual obligations arising from them; case files, in particular, are retained for the periods imposed by law and by professional duty. Once the purposes are met and those periods have run, the data is deleted.

Any substantial change to this policy will be communicated to data subjects before it is implemented, by publication on this website. Where the change concerns the purpose of the processing, fresh authorization will be sought.

Gamboa Abogados S.A.S. · NIT 830.107.424-1 · Carrera 7 # 76-35, Office 501, Bogotá D.C. 110221, Colombia · notificaciones@galegal.co · +57 601 321 1391