Personal Data Policy

GC Ventures S.A.S. (“GCR”, “we”), a Colombian company registered with the Cámara de Comercio de Medellín under NIT 900.256.843-6, is the data controller — the Responsable del Tratamiento — for the personal data described in this policy.

This policy is issued under Law 1581 of 2012, Decree 1377 of 2013 and Decree 1074 of 2015 — Colombia's Habeas Data regime.

GCR processes personal data in two clearly separate ways, and this policy covers both:

• This website — the contact forms, the newsletter signup, and the technical records our hosting provider keeps in order to serve the site. Section 3.
• Research fieldwork — data from the people who take part in our studies, across every methodology we run. Section 4.

The two are kept apart. A research participant is never added to a marketing list, and a website enquiry is never used as a research contact. Data collected for a study is used for that study.

We collect only what you type into a form. There is no hidden collection, no profiling, and no purchase of contact data from third parties.

This site sets no cookies. We run no analytics, no advertising tags, no tracking pixels and no social media widgets, and we store nothing in your browser. Typefaces are served from our own domain, so viewing a page does not disclose your visit to a font provider. See the Cookies notice.

If you have taken part in one of our studies — a focus group, an interview, a phone or online survey, a face-to-face intercept or an observational session — this section is the one that applies to you.

GCR is a member of ESOMAR, and fieldwork is conducted under the ICC/ESOMAR International Code on Market, Opinion and Social Research and Data Analytics as well as Colombian law. Two commitments in that code sit above everything else here: participation is voluntary, and what you say is reported so that it cannot be traced back to you.

What the client receives. Findings are delivered in aggregate. Your name and contact details are not passed to the client, and no answer is attributed to you personally, unless you have separately and explicitly agreed to that — for example where a study includes named expert interviews, or where a verbatim quote or a video clip is to be shown and you have authorized it.

Sensitive data. Some studies ask about matters that Colombian law treats as sensitive under article 5 of Law 1581 — health, for example. Where they do, we tell you so before you answer, your authorization is explicit and separate, and you are never obliged to answer. Declining a sensitive question does not remove you from the study or affect your incentive.

Withdrawing. You may stop at any point, decline any individual question, and ask us to delete your data afterwards. You do not have to give a reason, and it does not affect an incentive you have already earned.

Where the study is commissioned by a client, responsibility may be shared: GCR may act as Encargado del Tratamiento on the client's instructions while the client is the Responsable. The study-specific consent you are given at recruitment states which applies. This policy governs GCR's own handling in either case.

We process your data because you authorized it — you ticked the consent box before submitting a form, or you gave your consent at the start of a fieldwork session. That authorization is prior, express and informed, as Law 1581 requires, and we record when and how you gave it.

You may withdraw it at any time, without giving a reason and at no cost, by writing to [email protected]. Every newsletter also carries a one-click unsubscribe link. Withdrawing authorization does not affect processing already carried out lawfully before the withdrawal.

We do not sell personal data, and we do not share it for anyone else's marketing. It is disclosed only to those who need it to do the work, under contract and on our instructions:

• HubSpot, Inc. (United States) — customer relationship management, for website enquiries.
• EmailOctopus Ltd (United Kingdom) — newsletter delivery.
• Vercel Inc. (United States) — website hosting.
• Fieldwork partners across Latin America — recruiters, moderators, interviewers and transcribers, bound by confidentiality and by the ESOMAR code, and given only the data a specific study requires.
• The commissioning client — in aggregate, and identifiable only where you have explicitly authorized it (section 4).

We may also disclose data where a Colombian authority lawfully requires it, or where disclosure is necessary to establish or defend a legal claim.

International transfer. Some providers process data outside Colombia, in the United States and the United Kingdom, and a study run in another Latin American market is handled by a partner in that market. By authorizing the processing you authorize that transfer. We contract each provider and partner on terms that require a level of protection no lower than that required by Colombian law.

Colombian law sets no minimum retention period. Article 11 of Decree 1377 of 2013 sets a limit instead: personal data may be kept only for as long as is reasonable and necessary for the purpose that justified collecting it. Once that purpose is met we are required to delete it, and holding data indefinitely without a live purpose is itself a breach.

In practice, personal data from a study is deleted or irreversibly anonymised within six months of the project closing.

The databases described here remain in force for as long as the purposes above require, and are reviewed when those purposes are met.

The one exception is data we are legally obliged to keep. Where a legal or contractual duty applies, the data is retained for that duty alone — not reused for anything else — and a deletion request cannot override it:

Once those periods run out, the data goes the same way as everything else: deleted or irreversibly anonymised.

Article 8 of Law 1581 of 2012 gives you, as the Titular of the data, the right to:

• Know, update and rectify your personal data — including data that is partial, inaccurate, incomplete, misleading, or whose processing is prohibited.
• Request proof of the authorization you gave us, except where the law does not require it.
• Be informed, on request, how your data has been used.
• Bring a complaint before the Superintendencia de Industria y Comercio for breaches of the law.
• Revoke your authorization and request deletion of your data, where no legal or contractual duty requires us to keep it.
• Access your data free of charge.

One limit worth stating plainly: once a fieldwork dataset has been anonymised, the data is no longer personal data and there is nothing left to identify, correct or delete. We cannot reverse anonymisation, and we would not want to be able to.

Write to [email protected], or to the registered address above. Tell us who you are, how to reach you, and what you want. Attach something that identifies you, so we do not disclose data to the wrong person. If someone acts on your behalf, we will ask for proof of authority. If your request concerns a study, telling us roughly when and how you took part helps us find your record.

Requests are handled by GCR's data protection contact. Under article 16 of Law 1581, a complaint to the Superintendencia de Industria y Comercio can only be brought once you have gone through this process with us first.

The site is served over TLS. Form submissions are transmitted encrypted and processed on the server, never assembled in a third-party script in your browser. Access to the CRM is restricted to the people who need it, and credentials for our processors are held as encrypted environment secrets, never in the site's code.

Fieldwork data is held on access-controlled systems. Recordings and transcripts are available only to the research team working on that study, and fieldwork partners receive only what their part of the work requires. Everyone handling participant data is bound by confidentiality.

No system is perfectly secure. If a breach occurs that affects your data, we will report it as Colombian law requires and inform you where we are obliged to.

This website is a business-to-business site, it is not directed at children, and we do not knowingly collect personal data from minors through it. If you believe a minor has given us data through the site, write to us and we will delete it.

Research is different: some studies legitimately include minors. Where they do, we obtain verifiable authorization from a parent or guardian, we also seek the young person's own agreement to take part, and the processing respects their best interests and fundamental rights as article 7 of Law 1581 and the ESOMAR code require. A minor may stop at any time regardless of the authorization given for them.

If we change how we process personal data, we will update this page and change the date below. Where a change is substantial and affects the purposes you authorized, we will ask for your authorization again.

This policy is in force from 25 August 2026. It replaces the privacy and cookies policy previously published on gc-research.com.