Privacy and Personal Data Processing Policy

1. Controller and contact

The operational data controller is SISMATES Colombia, an independent technology project domiciled in Colombia. Send inquiries, complaints, updates, corrections, deletion or consent-withdrawal requests to sismates.colombia@gmail.com.

Legal identification and institutional channels may be updated before formal operation with public authorities. Material changes will be announced and a new authorization will be requested when authorized purposes change.

2. Data we process

Depending on the features you use, we may collect:

• Google identity: Firebase identifier, verified email, name and profile photograph.
• Citizen data: reports, descriptions, comments, photographs, dates and affected-site relationships.
• Location: coordinates and accuracy used for reports, visits and nearby confirmations.
• Professional data: identity document, professional card or license, diploma and a live photograph.
• Technical data: request identifiers, access and error logs, device information and security signals.

3. Purposes

We process information only for purposes related to SISMATES:

• Authenticate users, manage sessions and prevent anonymous abuse or fraud.
• Record, locate, display, moderate and track visible post-earthquake affected sites.
• Preserve traceability of reports, evidence, assessments, visits, decisions and triage scores.
• Review professional requests and enable the corresponding platform capabilities.
• Provide territorial reports, support, platform security and legal compliance.

4. Visible information and third-party data

An affected site’s location, description, photographs and history may be visible to SISMATES users and included in territorial reports. Professional accreditation documents are never published.

Do not upload identifiable faces, documents, license plates, contact details or private third-party information unless necessary and properly authorized. SISMATES may hide content to protect rights or address a flag.

5. Professional documents and sensitive data

Identity documents, professional credentials, diplomas and live photographs are used only to review the requested identity and accreditation. We do not perform biometric recognition or use the selfie for automated identification.

These files remain private and can only be viewed by the applicant and people expressly authorized to decide requests. They are excluded from maps, citizen reports and exports.

6. Providers and international processing

SISMATES uses technology providers for authentication, infrastructure, databases and storage, including Google/Firebase, MongoDB and S3-compatible services such as Cloudflare R2. Providers may process information from other countries under their contractual and security measures.

We do not sell personal data. Information is disclosed only to necessary processors, legally authorized authorities or third parties authorized by the data subject.

7. Retention and security

We retain data as needed to provide the service, preserve emergency traceability, resolve moderation or professional requests and meet legal duties. Final institutional retention schedules will be published before formal operation.

We apply reasonable authentication, access, storage-separation and traceability controls. No system is infallible; incidents and required notices will be managed under applicable law.

8. Your rights

Under Colombian Law 1581 of 2012, you may:

• Access, update and correct your personal data.
• Request proof of authorization and information about data use.
• Access processed personal data free of charge.
• Request deletion or withdraw consent when legally available.
• File a complaint with Colombia’s Superintendence of Industry and Commerce after completing the direct procedure when required.

9. Requests and deletion

Email sismates.colombia@gmail.com from the address linked to your account, describe the request and provide enough information to verify your identity. We will respond within applicable legal time limits.

Deletion may be limited by legal, contractual, security or emergency-history retention duties. We will explain the applicable basis when this occurs.

10. Children and updates

Registration is intended for adults. Children’s data must not be uploaded unless necessary, consistent with their best interests and supported by valid representative authorization.

The current version will remain available here. Material purpose changes will be announced and require renewed authorization when legally required.