Skip to content
Back to sunluglobal.com

Sun Lu S.A.S.

Personal Data Processing Policy

Version 1.0 · In force since September 27, 2026 · Colombian Law 1581 of 2012

This is a courtesy translation. The Spanish version is the legally binding text.

Sun Lu S.A.S. protects the personal data it receives from its clients, prospects, partners, suppliers and team members. This policy explains what data we process, why we use it, how we protect it and how you can exercise your rights.

1Data controller

Company name
SUN LU S.A.S.
Tax ID (NIT)
902.103.277-8
Commercial registration
946307 · Barranquilla Chamber of Commerce
Address
Carrera 42B1 # 83 - 66, Barrio Los Nogales
Domicile
Barranquilla, Atlántico, Colombia
Postal code
080020
Legal representative
Farid David Pareja Orozco
Phone and WhatsApp
+57 317 094 2502
Website
sunluglobal.com

3Definitions

Authorization
Prior, express and informed consent of the data subject to the processing of their personal data.
Database
Organized set of personal data subject to processing.
Personal data
Any information linked, or that can be associated, with one or more identified or identifiable natural persons.
Sensitive data
Data that affects the data subject’s privacy or whose misuse may lead to discrimination.
Data processor
Person who processes personal data on behalf of the controller.
Data controller
Person who decides on the database and the processing of the data; in this policy, Sun Lu S.A.S.
Data subject
Natural person whose personal data is processed.
Processing
Any operation on personal data, such as collection, storage, use, circulation or deletion.
Transfer
Sending personal data to a recipient that is, in turn, a data controller, inside or outside Colombia.
Transmission
Communicating personal data to a processor, inside or outside Colombia, so that it processes them on behalf of the controller.

4Principles

Sun Lu applies the principles of legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality set out in Article 4 of Law 1581 of 2012.

5Data we process

  • Identification and contact: name, position, email, phone and WhatsApp.
  • Company data: company name, industry, and the commercial, operational and financial information provided in the Sun Lu Diagnostic® assessment.
  • Technical preferences: the chosen language and the data needed for the site and the portal to work securely.

Sun Lu does not request sensitive data or data about minors.

6Purposes

  • Clients and prospects: preparing the Sun Lu Diagnostic® assessment and its report; preparing and presenting proposals; providing the contracted services; invoicing and managing payments; sending service-related communications and measuring satisfaction.
  • Partners and suppliers: managing the contractual relationship, payments and service evaluation.
  • Team members and candidates: carrying out selection processes and managing the employment or service relationship.
  • Site and portal users: answering contact requests, managing access to the portal and protecting the platform’s security.

7Sun Lu Diagnostic®

  • The assessment is completed in the Sun Lu Ecosystem Portal with a personal access code. The code must not be shared: whoever has it can view and change the answers.
  • The assessment’s reference number is only used to communicate with Sun Lu and never grants access to the information.
  • While the assessment is in progress, it may be saved encrypted in the device’s browser so it can be resumed later. The data subject can delete it at any time from the “Save and continue later” option.
  • Answers about financial information are optional.
  • Assessment records may only be viewed by Sun Lu’s management and by the staff it authorizes.

8Sensitive data and data about minors

Sun Lu does not collect sensitive data or data about children and adolescents. Should it exceptionally be necessary, it will request explicit authorization, state that providing it is optional and apply the safeguards required by law.

9Authorization

Sun Lu requests the data subject’s authorization no later than when the data is collected, in writing, orally or through unequivocal conduct, and keeps proof of it. In the portal, authorization is given on the screen before the assessment, which does not allow continuing without accepting it. Authorization is not required in the cases set out in Article 10 of Law 1581 of 2012.

10Data subjects’ rights

  • To access, update and correct their personal data.
  • To request proof of the authorization granted.
  • To be informed of how their data has been used.
  • To file complaints with the Superintendence of Industry and Commerce once the inquiry or claim process with Sun Lu has been completed.
  • To revoke the authorization or request the deletion of their data when there is no legal or contractual duty to keep it.
  • To access their personal data free of charge.

11Sun Lu’s duties

As data controller, Sun Lu fulfills the duties set out in Article 17 of Law 1581 of 2012; among them, guaranteeing the exercise of the data subject’s rights, keeping proof of the authorization, reporting the purpose of the collection, protecting the information against loss and unauthorized consultation, use or access, correcting data when appropriate, handling inquiries and claims within the legal deadlines and reporting security breaches to the authority.

12Inquiries and claims

Sun Lu S.A.S.’s General Management handles data subjects’ inquiries, claims and requests by email, or by phone and WhatsApp, through the channels listed in section 1. Anyone exercising their rights must prove their identity or that of their representation.

Inquiries

10 business days

Counted from receipt. If it is not possible to answer within that period, the reasons and the new date will be communicated; the extension will not exceed five additional business days.

Claims

15 business days

Counted from the day after receipt, extendable by up to eight additional business days, with prior notice of the reasons.

A claim must include the data subject’s identification, a description of the facts, an address to receive the answer and any supporting documents. If it is incomplete, you will be asked to complete it within the following five days; if two months pass without it being completed, it will be deemed withdrawn.

13Data transfer and transmission

To operate the portal, Sun Lu may rely on hosting and database technology providers located inside or outside Colombia, which act as data processors under contracts that require confidentiality and security measures. Sun Lu does not sell or assign personal data. Any international transfer will comply with Article 26 of Law 1581 of 2012.

14Information security

Sun Lu applies reasonable technical, human and administrative measures to protect personal data against tampering, loss and unauthorized consultation, use or access, including encrypted connections, access restricted according to each person’s profile and confidentiality commitments from the team.

15Local storage and cookies

The site and the portal store in the browser only technical preferences, such as the chosen language and the last access option used, and the encrypted progress of the assessment while it is under way. To keep access secure, the portal may use a strictly necessary session cookie. Sun Lu does not use advertising or third-party tracking cookies.

16Validity

This policy is in force since September 27, 2026. Data will be kept for as long as necessary for the purposes described and to meet the applicable legal, accounting and contractual obligations. Any substantial change will be published on this site before it applies.