Personal Data Processing Policy

The data controller (responsable del tratamiento) is Medardo Rafael Hernández Franco, a natural person identified by a Colombian citizenship ID card (cédula de ciudadanía), who acts under the trade name Rafael Hernández Franco · Asesor Inmobiliario.

Address: Carrera 14 # 45-27, Km 4, La Boquilla, Cartagena de Indias, Bolívar, Colombia. Email: rafaelhf.realestate@gmail.com. Phone and WhatsApp: +57 300 841 2677.

He personally handles inquiries and claims about personal data. There are no intermediaries or internal departments: you write to the email address or the WhatsApp number above and he answers you directly.

We collect what you give us when you contact us: your name, phone number, email address, the profile name you use on social media, and the content of the conversation—which project interests you, what budget you are working with, whether you are looking for a home or an investment, and in what time frame. In some cases, when you move toward a purchase, we also collect the identification details required by the builder’s client onboarding process.

That data reaches us through seven channels:

• The form on this website. We store what you write—your name, the phone number or email address at which you want us to contact you, the project that interests you, your approximate budget, how you would pay and what the purchase is for (in ranges, with a “Not sure yet” option), and your message—together with the record of your authorization: the date and time of submission, the version of the text you accepted, your IP address and the browser you submitted it from. That record exists for a reason: the law requires us to be able to prove that your authorization was prior, express and informed, and without it, keeping your data would be worse than not keeping it. On the “Sell or list your property” page, the form also asks for the location and type of the property. After submitting, if you prefer, you can continue the conversation on WhatsApp.
  The inquiry also carries how you found us. When you arrive on this website, your browser notes, only in the open tab and without cookies, how you first arrived: the campaign tags of the link (utm), the click identifier that Google or Meta add to their ads, the first page you saw and the domain of the site that sent you. That information does not leave your browser unless you submit a form; if you close the tab without submitting anything, it is deleted.
• Newsletter subscription. If you subscribe to the newsletter with news from Zona Norte, Cartagena’s northern corridor, we store your email address and the same record of your authorization: the date and time, the version of the text you accepted, your IP address and your browser.
• WhatsApp Business. When you write to us, we receive your number, your profile name and the messages you send. If you send a voice note, it is transcribed automatically on our own server so that the assistant can understand it.
• The assistant on WhatsApp and in this website’s chat. An automated assistant attends to you first and answers with public information about our portfolio. We store the text of those conversations in our sales management tool, to pick up where the conversation left off and to check that the assistant answers well; if you write on WhatsApp, the conversation is linked to your number. If you ask for a call with Rafael, the assistant records your name, the city you are writing from, your number (on WhatsApp, the one you are writing from; in the chat, the one you give us), the day and time you chose and a summary of what you are looking for, and Rafael receives the notification.
• Analytics and advertising cookies, only if you accept them. If you authorize it in the cookie notice, this website loads Google Tag Manager and Google Analytics (Google LLC) and the Meta pixel (Meta Platforms), which record how the website is used—pages viewed, WhatsApp clicks, brochure downloads, form submissions—in order to measure results and show ads for our projects. Without your authorization, none of them loads. You can change your decision whenever you want under “Cookie preferences,” at the bottom of every page.
• Instagram and Facebook. Direct messages and comments on our profiles.
• Trade fairs and in-person events. The paper forms you fill out at the service desk.

We do not collect sensitive data—health, ethnic origin, sexual orientation, political or religious beliefs, biometric data—and we will not ask you for it. If you happen to include any of it in a message on your own, we do not use it for anything and we delete it.

Your data is used to answer you, understand what you are looking for and show you the options in our portfolio that fit; to coordinate visits, appointments and the reservation or purchase process with the relevant builder; to send you information about projects, availability and prices when you have agreed to receive it; and to keep the internal record of our sales management, which includes how you found us, so we know which channels and which ads bring us inquiries.

If you subscribe to the newsletter, we use your email address only to send you the news from Zona Norte and updates on our portfolio. You can unsubscribe whenever you want by replying BAJA (Spanish for “unsubscribe”) to any newsletter or by writing to rafaelhf.realestate@gmail.com, and from that moment on you will not receive any more.

Sending promotional messages via WhatsApp requires your prior and express authorization. You can withdraw it at any time by replying BAJA to any of those messages, and we stop sending them to you. This does not affect the conversations you start or the answers to what you ask us.

We do not sell your data, we do not hand it over to third parties for their own advertising, and we do not use it for any purpose other than the ones you have just read.

We share data only with those who are needed to serve you: the builder or developer of the project that interests you, when you move toward a reservation or a purchase and that entity needs your data to onboard you as a client; and the technology providers that operate our channels, which act as data processors (encargados del tratamiento) and may not use your information for their own purposes.

Those providers are Meta Platforms (which operates the WhatsApp Business Platform, Instagram, Facebook and, if you accept cookies, its pixel); Google LLC (Tag Manager and Analytics, only if you accept cookies); the infrastructure provider that hosts this website and the customer service channel; the provider of the language model that powers the assistant, which processes the text of the conversation in order to answer you; Telegram, through which Rafael receives the notification of each inquiry or requested call; and the email and sales management tools we use. Some of them process information outside Colombia, which constitutes an international transfer; by accepting this policy you authorize that transfer under the terms of Articles 26 and 27 of Law 1581 of 2012 (Colombia’s personal data protection law).

We also provide information when a judicial or administrative authority requires it in the exercise of its functions.

Article 8 of Law 1581 of 2012 grants you rights that do not depend on our goodwill. You can find out what data of yours we hold and what we use it for, free of charge. You can ask us to correct data that is incomplete, outdated or wrong. You can revoke the authorization you gave and ask us to delete your data. You can demand proof of the authorization you granted. And you can file a complaint with the Superintendence of Industry and Commerce (SIC), Colombia’s data protection authority, if we assess your claim wrongly or do not answer you.

There is one limit worth stating up front: deletion does not apply when there is a legal or contractual duty to keep the data. If you signed a reservation (separación) or a preliminary purchase agreement (promesa), the records of that transaction are kept for the period required by commercial and tax law, even if you ask us to delete them.

Write to rafaelhf.realestate@gmail.com or to WhatsApp +57 300 841 2677, stating your name, a way to contact you so we can answer, and what you want: to consult, correct, update or delete your data. You do not need a lawyer or any special form.

Inquiries are handled within a maximum of ten business days, which may be extended by five more if we cannot make it in time, in which case we tell you the reason and the new date (Article 14 of Law 1581 of 2012). Claims—when you believe that some data should be corrected, updated or deleted—are handled within fifteen business days, which may be extended by eight more under the same rule (Article 15). While the claim is being processed, the data is marked “claim in process” (reclamo en trámite).

Filing the claim with us is a prerequisite for going to the SIC (Article 16). That is why it makes sense to start here: it is faster, and it is almost always resolved without getting that far.

If you want us to delete all the information we have about you, send a message to WhatsApp +57 300 841 2677 or an email to rafaelhf.realestate@gmail.com with the subject line “Eliminación de datos” (Spanish for “data deletion”), stating the phone number, email address or social media profile you contacted us from, so that we can identify your record.

Within the following fifteen business days, we delete your data from our databases and from our sales management tools—including your conversations with the assistant—and we confirm to you through the same channel that we have done so. We keep only what a legal or contractual duty requires us to keep, and in that case we tell you what remains and why.

Any conversation in the WhatsApp app on your own phone is yours, and you are the one who deletes it; we delete the copy on our side.

This website and our customer service channels are intended for persons of legal age with the capacity to enter into contracts. We do not knowingly collect data from minors. If we detect that some data belongs to a minor, we delete it.

We apply reasonable technical and administrative measures so that your data is not lost and is not within reach of anyone who should not see it: access restricted to whoever handles sales management, encrypted channels and providers with their own security controls. No measure is infallible, and we are not going to promise otherwise.

We keep your data for as long as the business relationship lasts and, afterwards, for the time needed to meet legal obligations or address claims. Once that period is over, it is deleted.

The newsletter email address is kept for as long as you remain subscribed. If you unsubscribe, it is no longer used for any mailing and is marked as unsubscribed, together with the record of your authorization, so that we can prove both. If you also want us to delete it, ask for it as explained in section 7.

For the inquiries that come in through the form on this website, the period is specific: two years from our last contact with you. That is how long a real estate decision stays alive and how long your inquiry still helps us answer you well. Once the two years are up, they are deleted, and if you ask us sooner, we delete them sooner—just write to us, as explained in section 7.

Conversations with the assistant on WhatsApp and in the chat are kept for two years from the last message, and we delete them sooner if you ask us to.

Those inquiries, the conversations with the assistant and the newsletter email addresses are stored in a database hosted on Cloudflare’s infrastructure, encrypted at rest. The form can only write to it; reading is done by the data controller with his own credentials, and it is not exposed on the website.

The inquiry and newsletter forms also use Cloudflare Turnstile, an automatic check that tells a person apart from a program before what you send is saved. For most people it is invisible: there is no image puzzle to solve. Turnstile does not install tracking cookies or use your data for advertising, and it runs on the same infrastructure that already hosts this website, so your inquiry does not go through an additional third party.

This policy is in effect from the date stated at the top and for as long as the databases we manage are maintained. If we modify it, we publish the new version at this same address, with its date; when the change affects the purpose of the processing, we inform you through the channel you use with us and ask for your authorization again.

Applicable framework: Law 1581 of 2012, Decree 1074 of 2015 (which compiled Decree 1377 of 2013, a regulation implementing Law 1581) and External Circular 002 of 2015 of the Superintendence of Industry and Commerce. The data controller is a natural person and, under Decree 090 of 2018, is not required to register his databases in the National Database Registry (Registro Nacional de Bases de Datos).