Personal Data Processing Policy
Version 1.3 · In force since November 2, 2026.
This is a translation for reference. The Spanish version governs.
In compliance with Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and other applicable rules, Medrar S.A.S. adopts this policy for the processing of the personal data it collects, stores, uses and deletes.
1. Data controller
| Item | Value |
|---|---|
| Company name | Medrar S.A.S. |
| NIT | 901.328.802-8 |
| Registered office | Armenia, Quindío, Colombia |
| Postal address | Calle 36 # 33-16, Armenia, Quindío, Colombia |
| Email for personal data matters | contacto@medrar.dev |
| Phone | +57 312 449 1446 |
| Website | https://medrar.dev |
2. Definitions
This policy uses the definitions in article 3 of Law 1581 of 2012: data subject (the natural person whose data is processed), personal data, public data, sensitive data, processing, controller and processor, and authorization.
3. Data we process
| Group | Data | How we obtain it |
|---|---|---|
| Business contacts (prospects) | Name, job title, company, corporate email, company website and the public source where the data was found | Public sources: company websites, LinkedIn company pages, job boards and open publications. We do not use purchased or leaked databases, or guessed email addresses |
| Clients and partners | Name, job title, ID document, email, phone and billing data | Directly from the data subject, when contracting or establishing the relationship |
| Engineers and candidates | Name, contact details, résumé, experience, skills, expected rates and the results of the technical tests they take | Directly from the data subject, with their prior and express authorization when applying |
| Medrar Tickets requesters | Name, company, email, the task description, the repository or technologies mentioned, the desired date and the approximate budget if provided | Directly from the data subject, through the “Post a ticket” form |
| Website visitors | The data the visitor writes in forms or emails. The site uses an anti-spam check (Cloudflare Turnstile) that may process technical browser data | Directly from the data subject |
We do not request sensitive data (health, racial or ethnic origin, political orientation, religious beliefs, biometric data, among others) or data of children or adolescents. If a candidate includes it on their own initiative in their résumé, it is not used for any decision and is deleted when detected.
Each message is reviewed and approved by a person at Medrar before it is sent, one by one. We do not send automated bulk messages or use automated extraction (scraping) from platforms.
Cloudflare Turnstile’s processing is governed by Cloudflare’s Turnstile Privacy Addendum.
4. Purposes
- Business-to-business (B2B) contact: sending, at most, a first message and up to two reminders with Medrar’s service offering (development teams with AI agents, MVPs, custom AI agents and document organization) through companies’ corporate contact forms, their LinkedIn company pages or corporate email, to companies and to people in their professional role, and following up if they reply.
- Handling Medrar Tickets requests: reviewing the submitted task, preparing the specification and the quote, and communicating with the person who sent it. We ask that the description not include passwords, keys or third parties’ personal data.
- Managing the client relationship: proposals, contracts, billing, support and service communications.
- Engineer selection: evaluating the application and technical tests, proposing training paths and presenting profiles to clients, always with the engineer’s prior authorization.
- Handling data subjects’ inquiries, claims and requests.
- Complying with legal, accounting and tax obligations.
Every commercial message includes a simple way to stop receiving messages: reply “no” or “unsubscribe”, or write to contacto@medrar.dev. The request is handled within 10 business days at most and that contact is permanently excluded.
Commercial messages are sent Monday to Friday from 7:00 to 19:00 and Saturdays from 8:00 to 15:00, in the recipient’s local time; never on Sundays or public holidays.
5. Use of artificial intelligence tools
Medrar uses artificial intelligence tools as support to:
- technically review the tests candidates submit (for example, whether the code passes its tests or is documented);
- identify companies that might need our services based on public information;
- draft communications;
- prepare draft specifications and quotes from Medrar Tickets requests, which a person reviews and approves before sending them.
No decision about a person is made solely by automated means. A person at Medrar reviews and decides whether a candidate moves forward, whether an email is sent and how to respond. Data subjects may ask for a person to review any evaluation that concerns them by writing to contacto@medrar.dev.
6. Data subjects’ rights
Under article 8 of Law 1581 of 2012, data subjects may:
- access, update and correct their data;
- request proof of the authorization, except where it is not required (for example, for public data);
- be informed about how their data has been used;
- file complaints with the Superintendence of Industry and Commerce (SIC);
- revoke the authorization or request the deletion of their data, where there is no legal or contractual duty to keep it;
- access their data free of charge.
7. How to exercise your rights
Write to contacto@medrar.dev with the subject “Datos personales”, stating your name, the email or data your request refers to and what you are asking for.
- Inquiries: answered within 10 business days at most, extendable by 5 more business days with notice of the reason.
- Claims (correction, update, deletion or revocation): answered within 15 business days at most, extendable by 8 more business days with notice of the reason. If a claim is incomplete, you will be asked to complete it within 5 days of its receipt.
Responsible area: the Management of Medrar S.A.S.
8. Security and processors
Medrar applies reasonable technical and administrative measures to protect data: restricted access, credentials separated by role, activity logs and human approval before any sending or decision.
To operate, it uses technology providers that may act as data processors, such as email services, web hosting, code repositories and artificial intelligence tools. Some store or process information outside Colombia, in countries with adequate levels of protection or under contractual safeguards, as permitted by law.
9. Retention
Data is kept for as long as necessary for the purpose that justified its collection, or while there is a legal or contractual duty.
- Medrar Tickets requests that do not lead to a contract: at most 12 months from the last communication.
- Prospects who do not reply: at most 12 months from the last contact.
- Candidates not selected: at most 24 months from their application, to consider them for future openings, unless they request deletion earlier.
- People who ask not to be contacted: only their data on the exclusion list is kept, to make sure they are not written to again.
10. Effective date and changes
This policy is effective from its publication. Any substantial change will be published at https://medrar.dev with its new effective date.
| Version | Date | Change |
|---|---|---|
| 1.0 | — | Internal draft (not published) |
| 1.1 | — | Internal draft (not published). Adds the tax ID and registered office, the use of artificial intelligence with human decision, candidate evaluation, the site’s anti-spam check and candidate retention periods |
| 1.2 | November 2, 2026 | First published version. Adds Medrar Tickets requests (data, purpose, AI support and retention) |
| 1.3 | November 2, 2026 | B2B contact: messages through corporate contact forms, LinkedIn company pages or corporate email; opt-out also by email, handled within 10 business days at most; sending hours; each message approved by a person before sending, without automated bulk sending or scraping |