Privacy Policy and Personal Data Processing

1. Introduction and purpose

FOUNDATION FOR INTEGRAL DEVELOPMENT IN GENDER AND FAMILY GENFAMI (hereinafter, “Genfami”, “us” or the “Controller”), identified with NIT 900291489-1, residing at 15th Street, #, 88-21, Suite 702, and email privacidad@ganfami.org, recognizes the importance of privacy and the protection of personal data of individuals who interact with its digital channels, social programs, and projects.

This Data Protection Policy (the “Policy”) governs the collection, storage, use, circulation, deletion, and other processing activities related to personal data obtained through the website https://genfami.org, its digital forms, messaging channels (including WhatsApp Business), associated social networks, and other Genfami contact points.

This Policy is issued in compliance with Law 1581 of 2012, Decree 1377 of 2013, Decree 1074 of 2015 (Chapter 25) of the Republic of Colombia and, where applicable, the General Data Protection Regulation (EU) 2016/679 (GDPR) for data subjects located in the European Economic Area.

2. Definitions

• Headline Natural person whose personal data is processed.
• Personal data: any information linked or that can be associated with an identified or identifiable natural person.
• Sensitive data: those that affect the privacy of the data subject or whose misuse could lead to discrimination (health, sexual orientation, biometric data, political opinions, data concerning minors, vulnerable socioeconomic situations, among others).
• Data controller: Genfami, who decides the purposes and means of processing.
• Data controller Natural or legal person who processes data on behalf of the Controller (technology providers, hosting, messaging, analytics).
• Authorization prior, express, and informed consent of the data subject for the processing of their personal data.
• Privacy Notice: physical, electronic, or verbal communication generated by Genfami to inform the holder about the applicable processing policies.

3. Personal Data We Collect

Depending on the channel and purpose, Genfami may collect the following categories of data:

3.1 Identification and Contact Information

• First name and last name.
• Type and number of document (when indispensable).
• Email, mobile phone number, city, country, and time zone.
• Cargo, community organization, or role (when applicable).

3.2 Sociodemographic and Contextual Data

• Age or age range, gender, preferred language.
• Approximate geographic location (city/municipality) for focusing social programs.
• Declared socioeconomic level, vulnerability status, and family environment conditions (when relevant to the program).
• Family composition (when required by the program).

3.3 Sensitive Data

When Genfami programs require it (emotional support, mental health, early childhood, family well-being), we may collect sensitive data such as: self-reported emotional state, well-being indicators, declared health conditions, family situation (separation, grief, violence), among others. The processing of this data requires express, explicit, and informed authorization from the data subject and will be carried out with reinforced security measures.

3.4 Minor Data

When a program is directed at children or adolescents, data will be supplied and authorized exclusively by the parent or legal guardian of the minor. Genfami will always protect the best interests of the minor, in accordance with Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013.

3.5 Navigation and Technical Data

• IP address (anonymized in analytics), browser type, operating system, device.
• Pages visited, time spent browsing, traffic source (UTM).
• Advertising identifiers (when applicable to Google Ads/Meta Ads).
• Cookies and similar technologies (see Part II — Cookie Policy).

3.6 Messaging and Interaction Data

• Content of messages exchanged via WhatsApp Business API and other conversational channels.
• Conversation metadata: timestamp, read status, template used, referral path.
• Labels and attributes assigned to the user in the management platform (Respond.io or other).

4. Purposes of the processing

Genfami processes personal data for the following purposes, subject to the data subject's authorization:

1. Manage the operation of Genfami's social programs, projects, and initiatives, including registration, support, monitoring, and impact indicators.
2. Communicate with the stakeholder to respond to requests, provide program information, and send content related to their participation.
3. Operate the website https://genfami.org and improve its functionality, security, and user experience.
4. Provide conversational support via WhatsApp Business API and associated digital channels, including automated flows with artificial intelligence support.
5. Activate clinical referral or specialized support protocols when the content of the conversation warrants it, in accordance with the Part IV Guidelines.
6. Send marketing communications, newsletters, and awareness campaigns, provided the data subject has expressly authorized this purpose (opt-in).
7. Measure the effectiveness of advertising campaigns on platforms like Google Ads and social media, as well as segment audiences for remarketing campaigns targeting adults.
8. Conduct statistical analyses, impact assessments, and reports for allies, donors, and cooperating entities, using aggregated or anonymized data.
9. Comply with legal, contractual, regulatory obligations, or requirements of competent authorities.
10. Attend to, process, and respond to inquiries, requests, complaints, claims, and the exercise of rights by data subjects.
11. Manage donations, volunteer work, and strategic partner relationships.
12. Empower the internal team and improve process quality, using anonymized examples.

5. Legal Basis for Processing

The processing of personal data by Genfami is primarily based on:

• Prior, express, and informed consent from the title, obtained through the mechanisms described in Part III of this document.
• Legitimate interest from Genfami as a social organization, since it pursues goals of collective well-being and the information is handled with measures that respect the fundamental rights of the data subject.
• Compliance with legal obligations applicable to Genfami and the programs it runs.
• Execution of an agreement a contractual relationship when there is a formal link with the holder.

6. Processing of sensitive data

Genfami does not condition the provision of its services on the supply of sensitive data, except when the nature of the program makes it indispensable. In all cases:

• Express, explicit, and independent authorization will be requested for the processing of sensitive data.
• The data subject may refuse to provide sensitive data without affecting their access to general information.
• Enhanced technical, administrative, and human security measures will be applied (encryption in transit and at rest, access control, anonymization in analytics, specific team training).
• Access will be restricted to strictly authorized personnel with signed confidentiality agreements.
• When possible and proportionate, anonymized or pseudonymized data will be used.

7. Processing of Minors' Data

Genfami handles the personal data of children and adolescents in accordance with the principle of the best interests of the child. Consequently:

• Authorization for treatment will be granted by the minor's father, mother, guardian, or legal representative.
• Consent will be obtained through verifiable mechanisms (digital form with a specific checkbox + confirmation email or equivalent).
• The minor's right to be heard will be respected and their opinion will be valued when they are mature enough.
• Personalized marketing, advertising profiling, or remarketing will not be conducted using data from minors.
• Information about minors will be kept only for the strictly necessary period for the purpose and will be subsequently deleted or anonymized.

8. Holder's Rights

Pursuant to Law 1581 of 2012, Decree 1377 of 2013, and, where applicable, the GDPR, the data subject has the following rights:

• Access: to access the personal data stored in Genfami's databases.
• Update and correction: request correction of partial, inaccurate, incomplete, or outdated information.
• Deletion: request the deletion of data when it is deemed that the data is not being processed in accordance with legal principles and obligations, or when the purpose for which it was collected has been fulfilled.
• Revocation of authorization: withdraw consent at any time, without retroactive effect.
• Authorization test: request evidence of consent granted.
• Usage information: to be informed about how your data has been used.
• File a complaint present complaints to the Superintendence of Industry and Commerce (SIC) in Colombia, or the competent authority in your country of residence.
• For EU/EEA headlines (GDPR): additionally, the right to data portability, to restrict processing, to object to processing based on legitimate interests, and not to be subject to automated decision-making with significant legal effects.

9. Procedure for Exercising Rights

The holder may exercise their rights by sending a request to the email address privacidad@ganfami.org indicating: (i) full name, (ii) type and number of document, (iii) clear description of the right being exercised, (iv) preferred contact channel for the response, and (v) when applicable, documentary support for the invoked right.

Response times:

• Inquiries: up to ten (10) business days from receipt, extendable by five (5) additional days.
• Claims: up to fifteen (15) business days from the day after receipt, extendable for an additional eight (8) days when justified.
• For data subjects covered by GDPR: up to thirty (30) calendar days, extendable by two (2) additional months in complex cases.

Data Conservation

Personal data will be kept for the time necessary to fulfill the informed purpose, attend to legal obligations, and resolve any potential claims. Reference times:

11. Data Controllers and International Transfers

To operate its services, Genfami relies on technological providers who act as data processors under contracts that include data protection clauses. The main ones are:

Some of these providers process data in countries that may not have the same level of protection as Colombia or the European Union. In those cases, Genfami requires contractual guarantees (Standard Contractual Clauses, Data Processing Addenda) and, where enforceable, transfer impact assessments.

12. Cookies, Google Analytics, and Google Ads

Genfami uses cookies and similar technologies to operate the website, measure its performance, and, with the owner's authorization, run advertising campaigns on platforms such as Google Ads and Meta Ads. The details, classification, and management mechanisms are described in Part II - Cookie Policy of this document.

Regarding Google Ads and Google Analytics, Genfami declares: (i) does not collect personally identifiable information through Google Ads tags without consent; (ii) does not use sensitive data (health, vulnerability, minors' data) for remarketing or ad targeting purposes; (iii) complies with Google's User Data Policy and Google's EU User Consent Policy; (iv) anonymizes IP addresses in Google Analytics when technically feasible.

13. Safety Measures

Genfami implements reasonable and proportionate technical, administrative, and human measures to the risk, aligned with good information security practices:

• In-transit encryption (HTTPS/TLS) on all website forms and communications.
• Role-based access control, multifactor authentication for personnel with database access.
• Confidentiality agreements signed by staff and suppliers.
• Internal Incident Management and Breach Notification Policy within Reasonable Timeframes (72 hours where GDPR applies).
• Periodic training for the team on data protection and digital security.
• Regular review and update of technology providers and their processing agreements.
• When viable, anonymization or pseudonymization of sensitive data.

14. Policy Modifications

Genfami may update this Policy whenever it deems necessary to reflect regulatory, operational, or technological changes. Any modification will be published at https://genfami.org, and when changes are substantial or affect authorized purposes, new authorization will be requested from the data subject through appropriate channels.

15. Control and Contact Authorities

For inquiries, exercise of rights, or complaints related to the processing of personal data:

Data controller: FOUNDATION FOR INTEGRAL DEVELOPMENT IN GENDER AND FAMILY GENFAMI

Email privacidad@ganfami.org

Address: 15th Street, #, 88-21, Bogotá, Colombia. 

Phone: +57 312 593 69 89

Supervisory Authority: Superintendence of Industry and Commerce (SIC) — Data Protection Delegation, Bogotá D.C., Colombia. www.sic.gov.co

16. Validity

This Policy is effective May 15, 2026, and supersedes any previous versions. Databases managed by Genfami are valid for the duration of the program or relationship with the data subject, without prejudice to the retention periods set out in section 10.