Privacy policy and processing of personal data

Effective: April 1, 2025 · Last updated: August 19, 2026

1. Who is responsible for your data

Scitis operates through two companies. Which one is responsible for processing your data depends on the country you contact us from.

The contact form includes a country field precisely so we can determine which of the two entities is responsible for your information.

2. What we collect

What you give us. First and last name, work email, company, role, country, phone number and the content of your message. If you apply for a position, the information in your CV as well.

What is generated as you browse. IP address, browser and device type, pages visited, time on page and referral source. See the cookie policy.

We do not ask for sensitive data. We do not request information about health, ethnic origin, sexual orientation, political or religious beliefs, or biometric data. Please do not include any of it in the form.

3. What we use it for

• Responding to your contact or information request.
• Scheduling and holding the discovery call we offer at no cost.
• Preparing and sending commercial proposals.
• Managing the contractual relationship, if we end up working together.
• Sending you communications about our services, where you have authorized it and with an opt-out in every message.
• Evaluating your application, if you apply for a position.
• Measuring how the site is used so we can improve it.

We do not sell your information to third parties, and we do not share it for advertising purposes.

4. On what basis

We process your data on the basis of the prior, express and informed authorization you give by checking the box on the form. That box is not pre-checked: checking it is your action. We keep a record of when, how and against which version of this policy it was given.

5. If you contact us from the United States

There is no general federal privacy statute in the United States equivalent to the Colombian one. Even so, we apply the principles described here across our whole operation.

• Commercial email. We comply with the CAN-SPAM Act: we identify the sender, include a physical postal address and provide a working opt-out in every message. Opt-out requests are honored within ten business days.
• State laws. As of today, neither the Florida Digital Bill of Rights nor California's CCPA/CPRA applies to Scitis LLC, since their revenue and data-volume thresholds are not met. If that changes, we will update this policy.
• Your requests. We handle access, correction and deletion requests within the same timeframes set out in section 7.

6. Your rights

• Know what information we hold about you and how we use it.
• Update and correct data that is partial, inaccurate, incomplete or misleading.
• Request proof of the authorization you gave.
• Withdraw that authorization at any time.
• Request deletion of your data, where no legal or contractual duty requires us to keep it.
• File a complaint with the Colombian Superintendence of Industry and Commerce, where Colombian law applies.

These rights are free of charge and you may exercise them yourself or through a representative.

7. How to exercise them

Write to legal@scitisgroup.com stating your name, the right you want to exercise and the data it concerns.

If an extension is necessary, we will tell you before the initial period expires.

8. Who else accesses your data

We rely on technology providers who act as processors and may only use your data on our instructions:

International transfers. Some of these providers are outside Colombia. In those cases we require contractual guarantees of an adequate level of protection, in line with Colombia's Law 1581 of 2012.

9. How long we keep it

Two years from the last contact, if you do not become a client. If we enter a contractual relationship, for its duration and for as long as legal, accounting and tax obligations require. CVs of candidates who are not selected are kept for two years, unless you ask us to delete them sooner.

10. How we protect it

We apply technical, human and administrative measures: encryption in transit through an SSL certificate, role-based access control, reinforced authentication on internal tools and confidentiality agreements with our team. If an incident affecting your data occurred, we would notify you and report it to the competent authority.

11. Minors

This site is aimed at professionals and organizations. We do not knowingly collect data from minors. If we detect that we have received information from a minor, we delete it.

12. Changes

We may update this policy. When we do, we will change the date in the header. If a change materially affects how we process your data, we will let you know.

13. Supervisory authority

Where Colombian law applies, the supervisory authority is the Superintendence of Industry and Commerce. You may file a complaint with it once you have submitted an enquiry or claim to us and it has not been resolved.