Privacy Policy

This Privacy Policy explains how USP Consultancy collects, uses, shares, stores and protects personal data, and how you can exercise your rights over it (known in Colombia as habeas data). It applies to personal data we receive through uspconsultancy.com (the “Website”), our forms, WhatsApp, email, phone and video calls, our social media profiles (such as Facebook, Instagram, LinkedIn, YouTube and TikTok), and in the course of providing our services.

We process personal data in accordance with Colombian Law 1581 of 2012, Decree 1377 of 2013 (now compiled in Decree 1074 of 2015) and other applicable data protection rules. Browsing the Website does not, by itself, authorize us to process your personal data; authorization is obtained as described in Section 5. This policy complements our Terms and Conditions.

In short: we only ask for the data each procedure needs, we use it only to serve you and to meet our legal duties, we never sell it, and you can access, correct or delete it by writing to info@uspconsultancy.com.

1. Data Controller

USP Consultancy
Trade name of Pablo César Ulcué Bolaños, sole proprietor — Colombia.
Nationwide coverage across Colombia. Remote-first practice; meetings by appointment.
Phone / WhatsApp: +57 321 720 4247
Email: info@uspconsultancy.com
Website: uspconsultancy.com
Hours: Monday–Friday, 8:30–17:30 (COT, UTC−5)

Data protection requests (inquiries, claims, updates, corrections, deletion and revocation of authorization) are received and handled by our client service team through the channels above, in English or Spanish, under the supervision of the Data Controller, who remains responsible for the processing. Team members and collaborators access personal data only as far as their tasks require.

2. Definitions

Personal Data: any information linked or that can be associated with an identified or identifiable natural person, such as name, email address, phone number, nationality, passport number or immigration status.

Public Data: data that is not private, semi-private or sensitive, such as data in public registries or in duly executed court rulings.

Sensitive Data: data that affects the privacy of the Data Subject or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political views, religious beliefs, sexual life or orientation, health, or biometric data.

Data Subject: the natural person whose personal data is processed.

Processing: any operation performed on personal data, such as collection, storage, use, circulation, transfer or deletion.

Authorization: the prior, express and informed consent of the Data Subject to the processing of their personal data.

Data Controller: the person who decides on the database and the processing of the data (USP Consultancy, as identified in Section 1).

Data Processor: a person or company that processes personal data on behalf of the Data Controller, such as a hosting or email provider.

Transfer and Transmission: a transfer sends personal data to another controller; a transmission sends it to a processor that handles it on our behalf. Either may take place inside or outside Colombia.

3. Information We Collect

We only ask for the data each procedure actually needs.

3.1 When you contact us. Through our forms, WhatsApp, email or social media we may collect your first and last name, email address, phone or WhatsApp number, nationality and country of residence, the service or visa category you are interested in, your main concern, and anything else you choose to tell us about your situation.

3.2 When you hire a service. Depending on the service, we may also collect:

• Visas and immigration: passport details, photographs, entry and exit records, current and past visas, criminal background certificates, proof of income, pension, savings or employment, health insurance policies and, for beneficiaries, proof of the family relationship
• Marriage, permanent partnership and family law: birth and marriage certificates, civil status, divorce or custody decisions, information about children and the property regime
• Real estate: property details, offers, purchase contracts, deeds, payment records and, when banks or notaries require it, documents on the source of funds
• Funds transfer and foreign investment: bank account details, foreign exchange declarations, transfer receipts and investment registration information
• Powers of attorney and notarial procedures: identification of the grantor and the attorney-in-fact, the scope of the power, and notarial and apostille records
• Business setup and investment: identification of partners or shareholders, company documents, tax registration (RUT) and commercial registry information
• Tax compliance: tax identification numbers, income, assets, debts, bank and investment statements, previous tax returns and the information third parties report about you to DIAN
• Health insurance quotes: age, nationality, the coverage you need and, only if the insurer requires it, health information
• Billing: billing name, identification or tax number, address for the invoice and payment confirmations. We do not store complete card details; card payments, if any, are processed directly by the payment provider.

3.3 From other sources. We may receive data about you from government authorities and public registries involved in your procedure, from family members, partners or employers who hire a service that includes you, from other professionals working on the same matter, or from people who refer you to us.

3.4 Communications. We keep the emails and WhatsApp messages related to your case as part of your file. We do not record calls or video meetings without asking you first.

3.5 Browsing data. When you browse the Website, some technical data is recorded automatically through cookies and server logs: IP address, browser and operating system, date and time of the visit, pages viewed and the website that referred you. We use it in aggregate to measure traffic, protect our forms from spam and improve the Website, not to identify you (see Section 10).

4. Purpose of Data Processing

We process personal data only for the following purposes:

• To answer your inquiries, schedule consultations and prepare quotes
• To assess your eligibility for visas and other services
• To prepare, file and follow up on visa applications, legal and notarial procedures and documents on your behalf
• To provide the business setup, investment, real estate, funds transfer and tax compliance services you hire
• To keep you informed about the status of your case and the deadlines that affect you
• To sign service agreements, issue invoices (including electronic invoices reported to DIAN), process payments and keep our accounting records
• To provide banks, notaries and authorities with the information they require under their own rules (for example, identity and source-of-funds checks), when you ask us to manage a procedure with them
• To comply with our legal and regulatory obligations, including those before the Ministry of Foreign Affairs (Cancillería), Migración Colombia and DIAN
• To verify identities and prevent fraud, spam and misuse of our channels
• To send you updates about changes in immigration rules or our services, only if you have agreed to receive them; you can opt out at any time
• To measure and improve the Website and our services using aggregated statistics
• To establish, exercise or defend legal claims

We use automated tools to organize inquiries, send confirmations and track deadlines, but we do not make decisions that produce legal effects on you based solely on automated processing: a person always reviews your case.

We will not use your personal data for any other purpose without first obtaining your authorization.

5. Authorization and Consent

We process your personal data with your prior, express and informed authorization. We obtain it in writing (for example, the consent box in our Website forms, our intake forms or the service agreement you sign), orally, or through unequivocal conduct, such as writing to us by WhatsApp or email to request information. In that last case, the authorization covers only what is needed to answer you. We keep proof of every authorization.

Authorization is not required for public data, for data related to the civil registry of persons, for information requested by an authority in the exercise of its legal functions or by court order, in medical or health emergencies, or in the other cases provided in Article 10 of Law 1581 of 2012.

Sensitive data. You are not required to provide sensitive data. Some procedures may involve it, for example:

• Photographs and biometric data required for visas and identity documents
• Health information requested by an insurer or by an authority
• Information that may reveal sexual orientation, such as a same-sex marriage or permanent partnership used for a beneficiary visa

In those cases we will tell you which data is sensitive and why we need it, and we will ask for your explicit authorization. We will not make any service conditional on sensitive data unless the service strictly requires it. We apply the same level of care to criminal background certificates.

Minors. Our services are directed to adults. We process data of minors only when a parent or legal guardian provides it and authorizes it, for example as beneficiaries of a family-based visa, always respecting the best interests of the child.

Data of other people. If you give us information about other people (such as family members, partners or employees), you confirm that you are authorized to share it for the purposes described here.

Revocation. You may revoke your authorization at any time by writing to info@uspconsultancy.com. Revocation does not apply where a legal or contractual duty requires us to keep the data, and it does not affect processing carried out before it.

6. Sharing Information and International Transfers

We share personal data only as needed to provide the services you request or to comply with the law, and only the data each recipient needs:

• Government authorities and public registries: the Ministry of Foreign Affairs (Cancillería), Migración Colombia, DIAN, the Banco de la República (foreign investment and exchange records), chambers of commerce, notaries, courts and other authorities involved in your procedure
• Collaborating professionals: attorneys, accountants, official translators and apostille or document services working on your case, all bound by confidentiality and, where applicable, professional secrecy
• Service providers you choose through us: for example insurers, when you ask for a health insurance quote, or banks involved in your transaction. They process the data as independent controllers under their own privacy policies
• Payment providers: banks, digital wallets and payment platforms you use to pay us, also under their own policies
• Courier services, when original documents must be sent
• Technology providers acting as Data Processors: website hosting (the information you submit through the Website is stored on our hosting provider's servers), email, cloud storage and office tools, messaging, scheduling, customer and case management, invoicing and workflow automation, under terms that require them to protect the data and use it only on our instructions
• Authorities with legal power to request it, when the law requires us to provide it

We do not sell or rent personal data, and we do not share it with third parties for their own marketing. If USP Consultancy's activity is ever transferred to another person, the data would pass to the successor under the same commitments as this policy, and we would inform you in advance.

International transfers. Some of our technology providers store data outside Colombia, mainly in the United States and the European Union. We work with providers that offer adequate levels of data protection and contractual safeguards, in line with Article 26 of Law 1581 of 2012 and the guidance of the Superintendence of Industry and Commerce (SIC). When your procedure involves a foreign authority or institution (for example, a consulate or the issuer of a document from your country), we send it only what the procedure requires, as part of performing the service you hired.

7. Your Rights

Under Article 8 of Law 1581 of 2012, you have the right to:

• Access your personal data, free of charge, at least once every calendar month and whenever this policy changes substantially
• Update and correct data that is inaccurate, incomplete or out of date
• Request proof of the authorization you gave us
• Be informed, on request, of how we have used your data
• Revoke your authorization and/or request deletion of your data, unless a legal or contractual duty requires us to keep it
• File complaints with the Superintendence of Industry and Commerce (SIC) for violations of data protection law, once you have completed the inquiry or claim process with us (Article 16 of Law 1581 of 2012)

These rights may be exercised by you, your successors, your legal representative or attorney, or by whoever you designate in favor of another person.

8. How to Exercise Your Rights

Send your request, free of charge and in English or Spanish, to info@uspconsultancy.com with the subject line “Data Protection Request”. Please include:

• Your full name and identification document number, so we can verify your identity
• A clear description of your request (if you are a client, your case or reference number helps us find your file faster)
• The email or address where you want to receive the answer
• Any supporting documents, if applicable

If you act on behalf of the Data Subject, attach proof that you are authorized to represent them. To protect your data, we may ask for additional information to confirm your identity before answering.

Inquiries (to know what data we hold and how we use it): we answer within ten (10) business days from the date we receive them. If we cannot answer in that time, we will tell you why and answer within five (5) additional business days.

Claims (to correct, update or delete data, revoke authorization, or report a possible breach of the law): we answer within fifteen (15) business days from the day after we receive them. If we cannot answer in that time, we will tell you why and answer within eight (8) additional business days. If the claim is incomplete, we will ask you to complete it within five (5) business days of receipt; if two (2) months pass without the missing information, the claim will be considered withdrawn. While a claim is being processed, the related data will be marked “claim in process” within two (2) business days.

9. Data Security

We apply reasonable technical, administrative and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure, including:

• Encrypted connections (HTTPS/TLS) on the Website and our communication tools
• Client files kept in business cloud storage with access limited to the people working on each case
• Multi-factor authentication on business accounts
• Confidentiality obligations for everyone who works on your case and, for attorneys, professional secrecy
• Spam and abuse protection on our forms
• Original documents, when a procedure requires them, kept safely and returned once the procedure ends

Protect yourself from fraud. We will never ask for your passwords. We only request payments through the methods stated in your quote or service agreement; if you receive a message in our name asking you to pay through a different channel, contact us before paying.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident affects your personal data, we will inform you and the Superintendence of Industry and Commerce (SIC) as required by law.

10. Cookies and Third-Party Services on the Website

The Website uses cookies and services from third parties for the following purposes:

• Analytics: Google Analytics helps us understand, in aggregate, how visitors use the Website (pages visited, time on page, type of device).
• Advertising measurement: Google Ads tags tell us whether our ads lead to inquiries through the Website.
• Form protection: our forms use Google reCAPTCHA to tell people from automated spam. reCAPTCHA collects technical data from your device and is subject to Google's Privacy Policy and Terms of Service.
• Embedded videos: some pages show YouTube videos. YouTube may set cookies when you play them.
• Fonts: some typefaces are loaded from Google's servers, which receive your IP address to deliver them.

These services are provided by Google and do not tell us who you are by name. You can block or delete cookies in your browser settings, install the Google Analytics opt-out add-on, or manage ad personalization in your Google account. Some features of the Website may not work properly without cookies.

When you click the WhatsApp button or links to our social media profiles, you leave the Website and the privacy policy of that platform applies.

11. Links to Third-Party Websites

The Website may link to websites and platforms that USP Consultancy does not operate, such as government portals, social networks and the websites of insurers or other providers. We are not responsible for their content or privacy practices, so we encourage you to read their privacy policies before sharing information with them.

12. Data Retention and Database Validity

We keep personal data only for as long as the purposes for which it was collected require:

• People who contacted us but did not hire our services: up to 24 months after the last contact, unless you ask us to delete the data sooner.
• Case files: while your matter is in progress. When it closes, we return your original documents and delete working copies, drafts and copies of identity documents that no longer support a legal obligation. Documents with accounting or tax effect stay under the rules below.
• Contracts, invoices and supporting documents: five (5) years after the contract ends or the tax period closes, as required by tax law.
• Accounting books: up to ten (10) years, as provided by commercial law.
• Records of your authorization and of your requests: for as long as the relationship lasts and for the time needed to answer claims or demonstrate compliance.
• Updates and newsletters: until you unsubscribe or revoke your authorization.
• Website statistics: for the retention period configured in Google Analytics.

When these periods end, or when a valid deletion request is accepted, the data is securely deleted or anonymized. Our databases remain in force for as long as USP Consultancy carries out its activities and the purposes described in this policy continue to apply.

13. Changes to This Privacy Policy

We may update this policy. Every new version will be posted on this page with its effective date and version number. We will announce substantial changes on the Website, or by email to the people affected, before they take effect. If a change affects the purposes for which we process your data, we will ask for your authorization again.

Version history: 1.0 (April 2026) · 2.1 (October 16, 2026).

14. Governing Law, Supervisory Authority and International Visitors

This policy is governed by the laws of the Republic of Colombia, in particular Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015). The authority in charge of personal data protection in Colombia is the Superintendence of Industry and Commerce (SIC): www.sic.gov.co.

Many of our clients come from other countries. If the law of the place where you live gives you additional rights over your personal data, write to us: we will review your request in good faith, in addition to the rights described in this policy.

15. Contact Us

If you have any questions about this policy or about how we handle your personal data, contact us:

USP Consultancy
Phone / WhatsApp: +57 321 720 4247
Email: info@uspconsultancy.com
Website: uspconsultancy.com
Hours: Monday–Friday, 8:30–17:30 (COT, UTC−5)