1. Data Controller Identification
In compliance with Colombian Law 1581 of 2012, Decree 1377 of 2013, the EU General Data Protection Regulation (GDPR), and other applicable regulations, the data controller is:
Legal Name: WORKFLOW SAS
Tax ID (NIT): 901523534-4
Legal Representative: DANIEL ANGEL POSADA AGUDELO
Registered Address: CR 47 #54-32, Medellín, Colombia
Privacy Email: info@weareworkflow.com
Website: https://weareworkflow.com
The Superintendencia de Industria y Comercio (SIC) is the entity responsible for overseeing data protection in Colombia.
2. Type of Authorization
In accordance with Article 9 of Colombian Law 1581 of 2012, personal data processing by WORKFLOW SAS is performed under:
Express Authorization: The data subject grants prior, specific, informed, and unambiguous authorization when registering on the platform, checking the Terms & Conditions acceptance box, or knowingly using the platform's services.
This authorization covers personal data processing for the purposes described in this policy. The data subject may revoke authorization at any time, following the procedures established in Section 9.
3. Personal Data Collected
3.1 Identification & Account Data
- Full name, email address, phone number, company name, and job title.
- Access credentials (password hashes, API tokens).
3.2 Chat & Conversation Data
- Text messages exchanged with the virtual assistant through the Bitrix24 messenger.
- Multimedia files sent in the chat (images, documents, audio).
- Audio transcriptions processed via speech recognition technology (Whisper).
3.3 CRM Data (Bitrix24)
- Leads, contacts, and deals created or updated by the assistant.
- Tags, custom fields, and sales pipeline stages.
3.4 Calendar Data
- Availability and appointments scheduled through Bitrix24, Google Calendar, or Microsoft Outlook.
3.5 Document & Knowledge Data
- Documents uploaded to the knowledge base (PDF, Excel, Word, indexed websites).
- Files accessed from Bitrix Drive.
3.6 Commerce Data
- Products queried, shopping carts, and orders managed via Bitrix24 Commerce.
3.7 Technical Data
- IP address, activity logs, Bitrix24 portal identifiers, browser type, and device information.
3.8 Payment Data
- Processed electronically by WORKFLOW INTERNATIONAL INC. through Stripe in USD.
- We do not store full credit/debit card numbers on our servers.
4. Purpose of Data Processing
Virtual Assistant Operation
Processing messages and audio, responding to queries, managing CRM, calendar, commerce, and documents.
Conversation Intelligence
Analyzing conversation patterns, identifying topics, generating recommendations and performance metrics.
Contractual & Billing Management
Subscription administration, usage measurement, plan renewals, and payment receipts.
Support & Security
Technical assistance, assistant improvement, and prevention of unauthorized access.
5. Special Processing of AI & Chat Data
Natural Language Processing: Text and audio messages are processed using large language models (LLM), speech-to-text (STT), and text-to-speech (TTS) to generate context-aware responses.
Knowledge Indexing: Uploaded documents are processed (chunked, vectorized) to enable semantic search capabilities.
Automated Analysis: Conversations may be analyzed to identify topics, patterns, and provide operational recommendations.
Encryption: Data is transmitted via TLS/HTTPS and stored on secure infrastructure.
No Data Selling: WORKFLOW SAS does not sell or trade personal data, messages, or recordings to third parties.
6. Service Providers & Data Processors
Bitrix24
CRM, messaging, calendar, commerce, and storage platform. Primary processor of chat, CRM, and assistant operation data.
DigitalOcean AI (Inference)
Hosting of the language model (LLM) used to generate assistant responses.
Stripe Inc. / WORKFLOW INTERNATIONAL INC.
Payment processing and subscription management.
Cloud Infrastructure
Kubernetes, MongoDB, Redis, ChromaDB — platform hosting and data services.
Google Calendar / Microsoft Outlook
Only if the User activates the calendar integration.
7. International Data Transfers
Personal data may be transferred and stored on servers located outside Colombia, in countries offering adequate protection or where necessary safeguards are in place:
- United States: Cloud infrastructure providers, payment processing (Stripe), and AI providers.
- European Union: Providers operating under GDPR safeguards.
In all cases, transfers are made under standard contractual clauses, binding corporate rules, or other adequate safeguards in accordance with applicable regulations.
8. Data Retention Periods
Account & Billing Data: During the account's lifetime and for five (5) years after closure, per accounting and tax obligations.
Chat Messages & Conversations: Up to twelve (12) months after the last interaction, unless the User requests earlier deletion.
Knowledge Base Documents: While the account is active and for thirty (30) days after deletion or account closure.
Activity Logs: Six (6) months from generation.
Analytics Data: Aggregated and anonymized data may be retained indefinitely for statistical purposes.
9. Data Subject Rights (Habeas Data / GDPR)
As a data subject, you have the right to:
- Access: Know what personal data WORKFLOW SAS holds about you and how it is processed.
- Rectification: Request updates or corrections of inaccurate or incomplete data.
- Erasure: Request deletion of your data when it is no longer processed in accordance with the law.
- Objection: Object to the processing of your data for specific purposes.
- Revocation: Revoke the authorization granted for data processing at any time.
- Portability: Request transfer of your data to another controller, where technically feasible.
- Information: Be informed about the use of your data and transfers to third parties.
To exercise any of these rights, send a detailed request to info@weareworkflow.com with the subject "Data Subject Rights Request - Habeas Data".
10. Data Deletion Procedure
To request data deletion:
- Send an email to info@weareworkflow.com with the subject "Personal Data Deletion Request".
- Clearly identify which data you wish to delete (total or partial).
- Processing will be completed within a maximum of ten (10) business days.
- You will receive confirmation once deletion is complete.
Note: Deletion of billing data may be subject to applicable legal retention obligations.
11. Security Measures
- Encryption in Transit: All communications use TLS/HTTPS protocols.
- Encryption at Rest: Stored data is encrypted in the database.
- Access Control: Restricted access to personal data via role-based authentication and authorization.
- Monitoring: Activity logs to detect suspicious access attempts.
- Infrastructure: Kubernetes deployment with load balancing and high availability.
- Backups: Periodic backup copies for data recovery.
12. Cookie Policy
- Essential: Authentication, security, and core functionality.
- Performance: Anonymous usage data for service improvement.
- Functionality: User preferences such as language and display settings.
Manage cookies through your browser settings. Disabling essential cookies may affect platform functionality.
13. Minors
The AIBot24 Enterprise platform is intended exclusively for individuals aged eighteen (18) or older and legal entities. We do not intentionally collect personal data from minors. If such data is discovered, it will be deleted immediately.
14. Contact & Support Channels
Email: consultoria@weareworkflow.com
Phone: +57 300 524 38 96
Hours: Monday – Sunday, 24 hours
Email: info@weareworkflow.com
Subject: ARCO Rights Request
WORKFLOW SAS
CR 47 #54-32, Medellín, Colombia
Legal Representative: DANIEL ANGEL POSADA AGUDELO
WORKFLOW SAS is committed to responding to data subject rights requests within the deadlines established by applicable law.