About Us · Data Protection
Personal Data Processing Policy
How PGA Consultores Empresariales SAS collects, uses, protects and enables you to exercise your rights over personal data, in accordance with Colombian Law 1581 of 2012 and other applicable data protection regulations.
We comply with Colombian data protection law
PGA Consultores Empresariales SAS (hereinafter "PGA") acts as Data Controller for the personal data it collects in the course of its business, and has adopted this policy in compliance with:
- Articles 15 and 20 of the Colombian Political Constitution, which enshrine the fundamental right to Habeas Data.
- Statutory Law 1581 of 2012, which sets out the general provisions for the protection of personal data.
- Regulatory Decree 1377 of 2013, compiled into Sole Regulatory Decree 1074 of 2015 (Title 2, Chapter 25).
- The Single Circular of the Superintendence of Industry and Commerce (SIC), Title V, Colombia's data protection authority.
This policy applies to the personal data of clients, business contacts, employees, job applicants, suppliers and visitors of the website pga.com.co.
Processing of personal data
PGA collects personal data through three main channels: (i) data that the data subject provides directly, for example by filling out contact forms, applying for a job opening, or registering for an event; (ii) data that a client shares with PGA in connection with an audit, statutory audit, BPO, consulting, tax or legal engagement; and (iii) data that an employer shares regarding its own employees for payroll, social security or HR outsourcing purposes.
Depending on the type of relationship and service contracted, the data processed may include identification and contact information, employment and contractual information, financial and accounting information, and, exceptionally, sensitive data when required by law or by the nature of the service (for example, in personnel selection or forensic audit processes), in which case the data subject's express authorization will be requested.
Purposes of processing
- Delivery of professional services. Perform the audit, statutory audit, BPO, consulting, tax and legal engagements entered into with clients.
- Compliance with legal and reporting obligations. Respond to requirements from the DIAN (tax authority), the Superintendence of Companies, the SIC, the UIAF and other competent authorities.
- Independence verification. Assess conflicts of interest and the audit team's independence, as required by the International Standards on Auditing.
- AML/CFT prevention. Apply our Self-Control and Money Laundering/Terrorism Financing Risk Management System (SAGRLAFT) and prevent fraud.
- Human talent management. Carry out recruitment, hiring, payroll and personnel administration processes, whether our own or on behalf of our outsourcing clients.
- Commercial communications. Send newsletters, event invitations and content of interest, only where the data subject has authorized this purpose.
- Customer support. Respond to inquiries, requests, complaints and claims (PQRSD), and improve the experience on our website.
Rights of data subjects
In accordance with Article 8 of Law 1581 of 2012, as a data subject you have the right to:
Know, update and correct
Your personal data held by PGA, particularly when it is partial, inaccurate, incomplete, fragmented or misleading.
Request proof of consent
Granted to PGA for the processing of your data, unless the law provides an exception to this requirement.
Be informed
About the use given to your personal data, upon request, within a maximum of 10 business days.
File complaints with the SIC
For breaches of Law 1581 of 2012, once the inquiry or claim procedure before PGA has been exhausted.
Revoke consent
And/or request deletion of the data, when no legal or contractual duty requires PGA to retain it.
Access free of charge
Your personal data that has been processed, as many times as it is reasonable to request.
International transfer and transmission of data
PGA maintains a strategic alliance with CLA Brasil, an independent member firm of the CLA Global network, and uses cloud-based tools and servers that may involve the transfer or transmission of personal data outside Colombia. Such transfers are made only to countries offering adequate levels of data protection, or under the exceptions and safeguards set out in Article 26 of Law 1581 of 2012, such as data transmission agreements that preserve the same protection standards required by Colombian law.
Data sharing
PGA may share your personal data with:
- Judicial and administrative authorities, in compliance with a legal obligation or a valid request.
- Technology providers and business partners that support service delivery, under confidentiality and data-processing agreements.
- Member firms of the CLA Global network, when the scope of the contracted service so requires.
In all cases, PGA requires these third parties to comply with security and confidentiality obligations equivalent to its own.
Storage and security of information
PGA has implemented reasonable technical, human and administrative measures to protect personal data against loss, unauthorized access, misuse, alteration or disclosure, including:
- Access controls to information based on role and need-to-know.
- Periodic backups and incident recovery protocols.
- Confidentiality agreements with employees, partners and third parties.
- Ongoing team training on the secure handling of information.
Cookie notice
Our website uses cookies and similar technologies to ensure it functions correctly, understand how it is used, and, with your consent, show you more relevant content. You may accept, reject non-essential cookies, or manage them from your browser settings at any time.
| Category | Purpose | Can it be disabled? |
|---|---|---|
| Essential | Necessary for navigation and basic site functions. | No |
| Analytics | Measure traffic and browsing behavior, on an aggregate basis. | Yes |
| Functional | Remember preferences such as the selected language. | Yes |
| Marketing | Personalize content and commercial communications, only with your consent. | Yes |
Exercise your rights
Inquiries, requests, complaints and claims (PQRSD) related to the processing of your personal data may be directed to PGA through the following channels. PGA will respond to inquiries within a maximum of 10 business days and to claims within a maximum of 15 business days, in accordance with Articles 14 and 15 of Law 1581 of 2012.
Data Controller: PGA Consultores Empresariales SAS · Tax ID (NIT) 900.634.301
Address: Cl. 98 #21-36, Office 501, Bogotá, Colombia
Email: informacion@pga.com.co
Phone: 311 538 2570
This policy may be amended at any time; changes will be published on this same page.
Last updated: August 2026Let's talk about how we handle your data
Our team can guide you on how to exercise your Habeas Data rights or resolve any concern about this policy.
Contact PGA