JRO Corlaw
ESEN

Legal

Personal Data Processing Policy

Version 1.0 · Issued and in force since 25 September 2026.

This is a courtesy translation. The operative text is the Spanish version, available at politica-de-datos.html. In case of discrepancy between the two versions, the Spanish version prevails.

1. Purpose

To set out the criteria under which JRO Florida Enterprises LLC (hereinafter “JRO Corlaw” or “the firm”) collects, stores, uses, circulates and deletes the personal data it processes in the course of its professional activity, and to describe the rights of data subjects and the procedures for exercising them.

2. Scope

This policy applies to all personal information recorded in JRO Corlaw’s databases, the firm acting as data controller (responsable del tratamiento), whatever the means by which the data are collected. It covers information relating to:

  • people who contact the firm through the website form, by email, by WhatsApp or through the website assistant;
  • clients, and their legal representatives, attorneys-in-fact, employees and contacts;
  • counterparties, witnesses and third parties whose information reaches the firm in the course of a professional engagement;
  • suppliers and contractors.

3. Binding effect

This policy is binding on JRO Corlaw, on the members of its professional and administrative team, and on third parties that process personal data on the firm’s behalf as data processors (encargados). Non-compliance gives rise to the contractual, disciplinary and legal consequences that may apply.

4. Data controller

Company name: JRO Florida Enterprises LLC.

Domicile: State of Florida, United States.

Address for notices: 5475 N University Dr, Suite 7606, Lauderhill, Florida 33351, United States.

Tax identification (EIN): 87-1850621.

Email address for personal data matters: legal@corlaw.com.co.

Telephone and WhatsApp: +1 862 977 1223.

Website: www.corlaw.com.co.

5. Definitions

The definitions in article 3 of Law 1581 of 2012 apply. In practical terms: the titular is the natural person whose data are processed; the responsable decides on the database and its processing; the encargado processes data on the controller’s behalf; the autorización is the data subject’s prior, express and informed consent; tratamiento is any operation on personal data, including collection, storage, use, circulation and deletion; and datos sensibles are those affecting the data subject’s privacy or whose misuse may give rise to discrimination. These Colombian terms are kept in Spanish because their scope does not map exactly onto the controller/processor vocabulary of other jurisdictions.

6. Data processed

6.1 Identification and contact data

Name and surname, identity document where the engagement requires it, email address, telephone, company and position.

6.2 Data on the matter enquired about

The account of the enquiry, the documents the data subject sends, and the information generated in the course of the professional engagement.

6.3 Browsing data

Technical data on the visit to the website, collected through Google Analytics 4 and the Google Ads tag. These tools are not activated until the visitor accepts the use of cookies in the notice shown on entering the site; until then, the site runs on strictly necessary cookies only. Contact form submissions are processed through Formspree.

6.4 Sensitive data and data of children and adolescents

JRO Corlaw does not request sensitive data through the website. Where processing them becomes necessary in the course of a professional engagement, express authorisation will be requested and the data subject will be informed that answering questions on sensitive data, and on data of children and adolescents, is optional.

7. Processing and purposes

The processing carried out by JRO Corlaw consists of the collection, storage, use, circulation and deletion of personal data, for the following purposes:

  1. to receive, assess and answer the enquiries received through any of the firm’s channels;
  2. to check for conflicts of interest before accepting an engagement;
  3. to provide the legal, accounting and tax services engaged, and to act as attorney where a power of attorney is granted;
  4. to conduct proceedings before administrative and judicial authorities in the client’s interest;
  5. to invoice, collect and keep the firm’s accounts;
  6. to comply with the applicable legal, accounting, tax and anti-money-laundering obligations;
  7. to keep the matter file and the records of the professional relationship;
  8. to measure use of the website and the effectiveness of its digital advertising campaigns, on an aggregate basis and subject to prior acceptance of cookies.

The firm does not send newsletters or commercial or informational communications using the data it collects through these channels. Data from an enquiry are used to answer it and for the other purposes listed, not for advertising.

8. Authorisation

Authorisation is obtained before processing and by a means that allows evidence of it to be kept. On the website it is obtained through a checkbox that the visitor ticks voluntarily before submitting the form, with a visible link to this policy. In professional engagements, it is recorded in the services agreement or in the engagement acceptance document.

The data subject’s silence does not amount to unequivocal conduct and therefore does not constitute authorisation.

Cases where the law does not require authorisation. Article 10 of Law 1581 of 2012 excepts, among others, information required by a public or administrative body in the exercise of its statutory functions or by court order, data of a public nature, medical or health emergencies, processing authorised by law for historical, statistical or scientific purposes, and data relating to the Registro Civil de las Personas (the Colombian civil registry).

9. Rights of data subjects

As the subject of your personal data, you have the right to:

  1. access, free of charge, your data that have been processed;
  2. know, update and rectify your information where data are partial, inaccurate, incomplete, fragmented, misleading, or where their processing is prohibited or has not been authorised;
  3. request evidence of the authorisation granted;
  4. be informed of the use made of your personal data;
  5. file complaints with the Superintendencia de Industria y Comercio (the Colombian data protection authority) for breaches of the personal data protection regime;
  6. revoke the authorisation and request deletion of the data, provided no legal or contractual duty prevents their deletion;
  7. decline to answer questions on sensitive data or on data of children and adolescents.

Revocation of the authorisation and deletion of the data do not apply where the firm has a legal or contractual duty to keep the information. That is the case of the file of an ongoing matter, of accounting and tax records, and of the documentation supporting compliance with anti-money-laundering obligations.

10. Handling of requests, enquiries and claims

The channel set up to receive and handle requests, enquiries and claims about personal data is the email address legal@corlaw.com.co. They may also be submitted in writing at 5475 N University Dr, Suite 7606, Lauderhill, Florida 33351, United States, or by WhatsApp on +1 862 977 1223.

The area responsible for handling them is the Legal Management office (Gerencia Legal). The fact that a data subject does not address the request to that channel does not relieve the firm of its duty to resolve it.

11. Procedure for exercising the right of habeas data

To file and handle your request we ask you to provide:

  • full name and surname;
  • contact details: physical or electronic address and telephone;
  • the means by which you wish to receive the reply;
  • the facts giving rise to the request and a brief description of the right you wish to exercise (to know, update, rectify, request evidence of the authorisation, revoke it, delete or access the information);
  • identification number and signature, where applicable.

11.1 Enquiries

An enquiry is handled within a maximum of ten (10) business days from the day following its receipt. Where it is not possible to handle it within that term, the interested party will be informed of the reasons for the delay and of the date on which it will be handled, which shall in no case exceed five (5) business days following the expiry of the first term.

11.2 Claims

If the claim is incomplete, the interested party will be asked to complete it within five (5) days of its receipt; if two (2) months pass without the requested information being provided, the claim will be deemed withdrawn.

Once the complete claim has been received, a note reading “reclamo en trámite” (claim under review) and the reason for it will be added to the database within no more than two (2) business days, and kept until the claim is decided.

The maximum term for handling a claim is fifteen (15) business days from the day following the date of its receipt. Where it is not possible to handle it within that term, the interested party will be informed of the reasons for the delay and of the date on which it will be handled, which shall in no case exceed eight (8) business days following the expiry of the first term.

11.3 Complaint to the authority

Where a claim is submitted to a party that is not competent to hear it, it will be forwarded to the party that is, and the interested party will be informed.

Once the above procedure has been exhausted, a data subject who is refused, in whole or in part, the exercise of the rights of access, update, rectification, deletion or revocation may bring the matter before the Superintendencia de Industria y Comercio, Delegatura para la Protección de Datos Personales.

12. Processors and transfers abroad

To operate, the firm uses third-party services that process data on its behalf:

  • Hostinger — website hosting and corporate email.
  • Google — Google Drive for storage of working files, and Google Analytics 4 and Google Ads for website measurement, the latter two active only after cookies have been accepted.
  • Dropbox — storage of working files.
  • Formspree — processing of contact form submissions.

JRO Corlaw is domiciled in the United States and its providers store or process information outside Colombia. Article 26 of Law 1581 of 2012 prohibits the transfer of personal data to countries that do not provide adequate levels of protection, and the Superintendencia de Industria y Comercio maintains the list of those countries in section 3.2 of Chapter Three of Title V of its Circular Única. The United States is on that list.

Each processor is required to process the information solely for the purposes of this policy, to keep it under secure conditions and not to use it for its own purposes.

13. Information security

The firm adopts reasonable technical, human and administrative measures to protect the information against unauthorised access, loss, alteration or fraudulent use. These include:

  • two-step verification on corporate email accounts;
  • access to client files limited to the members of the team involved in each matter;
  • the professional duty of secrecy (deber de reserva profesional) owed by the firm’s lawyers and support staff.

14. Term of this policy and retention period

This policy is in force from 25 September 2026.

The databases in which personal data are recorded will remain in force for as long as the information is kept and used for the purposes described. As a general rule, data are kept for the duration of the professional relationship and for five (5) years from its termination or, where there was no engagement, from the last communication with the data subject. Once that period has elapsed, and provided no legal or contractual duty requires them to be kept for longer, the data are deleted.

15. Amendments to this policy

Any substantial change in the purposes of the processing will be communicated to data subjects before it is implemented, through the contact channel on record, and will give rise to a new authorisation where the law so requires. The version in force is the one published at www.corlaw.com.co, with the effective date shown at the beginning.