Legal
How Goyen Legal processes personal data under Colombian law, and how you can exercise your rights.
Version 2.0 · Effective 25 September 2026
At a glance
Controller. Goyen Legal, based in Bogotá, Colombia. Full details are in section 2.
What we collect. What you give us when you write, call or apply, and what we need to provide legal services.
Why. To respond to you, run conflict checks, provide and administer our services, meet legal obligations and recruit.
Cookies. This site uses no cookies. Its statistics are aggregate and use no identifiers.
Your rights. Access, update, correct and delete your data, and withdraw your authorization. We answer inquiries within 10 business days and complaints within 15.
Contact. contacto@goyenlegal.com, subject “Data protection”.
1. Scope and legal framework
This policy explains how Goyen Legal collects, uses, stores, shares and deletes personal data. It implements article 15 of the Colombian Constitution, Statutory Law 1581 of 2012, Decree 1074 of 2015 (chapters 25 and 26 of title 2, part 2, book 2) and the instructions of the Superintendencia de Industria y Comercio (SIC), Colombia’s data protection authority.
It applies to personal data we hold in any format about people who contact us, clients and prospective clients, counterparties and other people involved in the matters we handle, job applicants, suppliers and visitors to goyenlegal.com. Data about our own staff is also governed by employment law and our internal policies.
This English version is provided for convenience. If it differs from the Spanish version, the Spanish version prevails.
2. Data controller
The data controller is Goyen S.A.S., a Colombian company that operates under the name Goyen Legal.
Domicile: Bogotá D.C., Colombia.
Address: Carrera 11 No. 94A-25, Office 703, Bogotá D.C., Colombia.
Email: contacto@goyenlegal.com
Phone: +57 313 890 5324
In this policy, “Goyen Legal”, “the firm”, “we” and “us” refer to the controller.
3. Key terms
We use the definitions of Law 1581 of 2012 and Decree 1074 of 2015. The most relevant are:
Personal data: any information linked to, or that can be associated with, an identified or identifiable individual.
Sensitive data: data that affects a person’s privacy or whose misuse may lead to discrimination, such as racial or ethnic origin, political views, religious or philosophical beliefs, membership of trade unions or of social or human rights organizations, health, sex life and biometric data.
Data subject: the individual the data relates to.
Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
Controller and processor: the controller decides on the database or the processing; the processor handles data on the controller’s behalf.
Authorization: the data subject’s prior, express and informed consent.
Transmission and transfer: a transmission is the communication of data to a processor, in or outside Colombia, to be processed on our behalf; a transfer is the sending of data to another controller, in or outside Colombia.
4. Principles
We process data in line with the principles of legality, purpose limitation, freedom of consent, accuracy, transparency, restricted access and circulation, security and confidentiality. In practice, we only ask for data that is relevant to a purpose we have explained to you, we do not use it for incompatible purposes, and only the people who need it for their work can access it.
5. Data we process and where it comes from
Depending on your relationship with the firm, we may process the following data:
People who contact us
Name, company, position, contact details and whatever you include in your message, whether you use the contact form, email, phone or WhatsApp. WhatsApp is a third-party service (WhatsApp, owned by Meta) governed by its own terms and privacy policy.
Clients and prospective clients
Identification and contact details of the individuals who are clients or act for a client (representatives, directors and officers, employees, shareholders and beneficial owners), the data needed for onboarding and billing, and the information that forms part of the matters entrusted to us.
Counterparties and other people involved in a matter
Data about people who take part in the matters we handle, such as counterparties, their representatives or counsel, witnesses, experts and officials, which we receive from our client, from the parties themselves or from public sources.
Job applicants
The data in your application: identification and contact details, education, experience, professional information, your CV and, if you include them, references.
Suppliers and contractors
Contact details of their representatives and liaison staff, and the data needed for contracting, payment and tax compliance.
Website visitors
Technical connection data generated when you browse: IP address, browser type, pages visited, referring page, time zone and language. We do not use it to identify visitors (see section 9).
Sources
We obtain data directly from you; from a client or its organization when it instructs us; from third parties you have authorized; and from publicly accessible sources where the data is public in nature, such as commercial registries, official gazettes and court decisions. Information is not public in nature merely because it is available online, and we treat it accordingly.
6. Purposes of processing
We process data for the following purposes, depending on the group to which the data subject belongs:
Inquiries and contacts
Respond to your request and stay in touch about it.
Check for conflicts of interest before accepting a matter, as the practice of law requires.
Prepare and send proposals.
Clients
Provide the legal services engaged, including representation before authorities and case management.
Administer the relationship: onboarding, communications, billing, collections and requests.
Verify the client’s identity and, where the law or our client-intake rules require it, screen against restrictive lists and public sources to prevent money laundering, terrorist financing and corruption risks.
Meet legal, accounting, tax and professional obligations.
Counterparties and other people involved in a matter
Handle the matters our clients entrust to us and establish, exercise or defend rights in judicial, arbitral or administrative proceedings.
Job applicants
Assess your application, verify the information and communicate with you during the recruitment process.
With your authorization, consider you for similar openings for the period stated in section 12.
Suppliers
Select, contract and pay for goods and services, and meet contractual, accounting and tax obligations.
All data subjects
Respond to requests from competent authorities and comply with court or administrative orders.
Protect the security of our systems and prevent fraud or misuse.
Send institutional communications, such as publications or invitations, only to people who have authorized them or ask to receive them. You can opt out at any time.
Produce aggregate statistics on the use of the site to improve it.
We do not sell personal data or use it for targeted advertising. If we need to use your data for a purpose not described here, we will tell you and, where required, ask for a new authorization.
7. Sensitive data and data about children
We do not request sensitive data through this site. If a matter requires processing it, we do so only with the data subject’s explicit authorization or where the law allows it, for example to establish, exercise or defend a right in judicial proceedings. When we ask for sensitive data, we will tell you which data is sensitive and that you are not required to provide it; nothing will depend on your providing it.
This site is not directed at minors. When a matter involves data about children or adolescents, we process it in their best interests and with respect for their fundamental rights, with the authorization of their legal representative, as required by article 7 of Law 1581 of 2012 and article 2.2.2.25.2.9 of Decree 1074 of 2015.
8. Technology tools and artificial intelligence
To support our work, we may use technology tools, including some that incorporate artificial intelligence systems, to organize and classify documents, extract and summarize information, search legal sources, review documents, manage internal knowledge and workflows, strengthen information security (for example, by detecting fraud or malicious email) and support administrative tasks.
Their use is subject to these rules:
Support, not substitution. Legal analysis and advice are provided by the firm’s lawyers. No tool issues legal opinions on its own or makes, by itself, decisions that produce legal effects for you.
Human oversight. A person reviews the output before it is used in professional work.
Confidentiality and professional secrecy. Client information is protected by professional secrecy. It is processed only in tools whose contractual and technical terms are compatible with that duty, and we do not allow confidential client information to be entered into public services that may use it to train models or disclose it.
Purpose, necessity and proportionality. We use only the data essential to the task and to the purpose for which it was collected, following the suitability, necessity, reasonableness and proportionality criteria of SIC External Circular 002 of 2024.
Security. We apply access controls and technical, human and administrative measures, and require providers acting as processors to commit to confidentiality and security.
Prior assessment. Before adopting a tool whose use may pose a high risk to data subjects, we assess and document its privacy impact.
This website does not use artificial intelligence to analyze visitors or to make decisions about them. If you want to know whether your data has been processed with these tools, you can ask us through the channel described in section 14.
9. Cookies and site technologies
This site does not set cookies or store information in your browser for analytics, advertising or profiling. To work, it relies on the following:
Hosting and statistics. The site is hosted on Framer, which provides us with aggregate usage statistics (pages viewed and links used) and loads an editing tool reserved for the people who manage the site. The statistics use no cookies or persistent identifiers; to produce them, Framer receives technical data from each visit, such as the IP address and browser type.
Third-party resources. Typefaces are downloaded from Google Fonts and a code library from Cloudflare’s cdnjs service. These providers receive the IP address and the technical data needed to deliver the files, without setting cookies.
Content you choose to load. The Google Maps map in the article about our base in Bogotá loads only if you ask for it; when it does, Google receives browsing data under its own policies. Links to WhatsApp, LinkedIn or Instagram take you to third-party services that process your data under their own terms.
Because we do not use optional cookies, the site does not display a cookie banner. If we ever add technology that requires one, we will ask for your prior consent and you will be able to refuse it. You can also set your browser to block or delete cookies at any time.
10. Who we share data with
We share personal data only when needed for the purposes in this policy:
With processors that provide technology and support services, such as hosting for the site and its forms (Framer) and cloud email and productivity tools, under contracts that require them to process the data only on our behalf, confidentially and securely.
With other advisors, correspondent firms or experts involved in a matter, when the client authorizes it or the engagement requires it.
With judicial or administrative authorities, when they order it in the exercise of their functions or when needed to exercise or defend a right.
With auditors, accounting advisors or financial institutions, to the extent needed to meet legal and contractual obligations.
International transmissions and transfers
Some of our technology providers store or process data outside Colombia, mainly in the United States and in member states of the European Union, which the SIC recognizes as providing an adequate level of data protection. If a transmission or transfer is to a country without that recognition, we will make it only if one of the conditions of article 26 of Law 1581 of 2012 is met or with the SIC’s declaration of conformity.
11. Security and confidentiality
We protect personal data with reasonable technical, human and administrative measures against alteration, loss and unauthorized or fraudulent access or use: an encrypted connection to the site (HTTPS), access controls and authentication in our tools, access limited to what each task requires, and confidentiality commitments from our staff and providers.
Client information is also covered by professional secrecy, which article 74 of the Colombian Constitution declares inviolable and which the Lawyers’ Disciplinary Code (Law 1123 of 2007) requires lawyers to keep even after an engagement ends.
If an incident puts data subjects’ information at risk, we will report it to the SIC as the law requires and take steps to contain it.
No system is completely secure. That is why we ask you not to send confidential or sensitive information through this site before we confirm that we can take on your matter.
12. Retention
We keep personal data only for as long as is reasonable and necessary for the purpose for which it was collected and for as long as applicable law requires, including the rules on keeping commercial and accounting records and the limitation periods for possible claims. As a reference:
Inquiries that do not become engagements: up to two years from the last communication, unless you ask us to delete them sooner. We may keep a minimal record (names of the parties and of the matter) to meet our conflict-of-interest duties.
Clients: for the duration of the engagement and afterwards for the periods required by law and needed to deal with possible claims.
Job applicants: for the duration of the recruitment process and up to 12 months afterwards, if you authorized us to consider you for other openings.
Suppliers: for the duration of the relationship and the accounting and tax retention periods.
When those periods end, we delete or anonymize the data. The firm’s databases remain in force for as long as the purposes described here subsist and the firm carries on its activities.
13. Your rights
As a data subject, you have the right to:
Access, update and correct your data, including data that is partial, inaccurate, incomplete, fragmented or misleading.
Request proof of the authorization you gave, except where the law does not require one.
Be told, on request, how we have used your data.
Withdraw your authorization and request the deletion of your data where no legal or contractual duty requires us to keep it.
Access your data free of charge at least once every calendar month and whenever this policy changes substantially.
File complaints with the Superintendencia de Industria y Comercio about breaches of data protection law, once you have completed the inquiry or complaint procedure with us.
These rights may be exercised by you, your successors, your representative or attorney-in-fact, or a third party under a stipulation in your favor, with proof of that capacity. The rights of children and adolescents are exercised by their legal representatives.
14. How to exercise your rights
Write to contacto@goyenlegal.com with the subject “Data protection”, or send a letter to Carrera 11 No. 94A-25, Office 703, Bogotá D.C., Colombia. Please include your name, a way to reply to you, a description of your request and, if you act for someone else, proof of your authority. We may ask for reasonable additional information to verify your identity.
Inquiries
If you want to know what information we hold about you, we will answer within ten (10) business days of receipt. If that is not possible, we will explain why and tell you when we will answer, which will be no later than five (5) business days after the first deadline.
Complaints
If you believe your data should be corrected, updated or deleted, want to withdraw your authorization or notice a possible breach of the law, you can file a complaint describing the facts and attaching any documents you wish to rely on.
If the complaint is incomplete, we will ask you to complete it within five (5) days of receipt. If we do not receive the information within two (2) months, the complaint will be deemed withdrawn.
Once it is complete, we will flag it as “complaint in progress” within two (2) business days.
We will resolve it within fifteen (15) business days from the day after receipt. If that is not possible, we will tell you why and give you a new date, no later than eight (8) business days after the first deadline.
If you are not satisfied with our answer, you can turn to the Superintendencia de Industria y Comercio (www.sic.gov.co).
15. Responsible area
Inquiries, complaints and requests about personal data are handled by Goyen Legal’s data protection area at contacto@goyenlegal.com.
16. Effective date and changes
This policy takes effect on 25 September 2026 and replaces the previous version published on this site. If we change it substantially, particularly regarding the controller’s identity or the purposes of processing, we will publish the new version on this page and communicate it through our usual channels before applying it; where the change affects the purpose, we will ask for a new authorization.
Last updated: 25 September 2026.
See also our Legal Notice.