This policy describes how nojau S.A.S., hereinafter "nojau", "we" or "the platform", collects, uses, stores, shares and protects the personal data of the individuals it interacts with, in compliance with Colombian Law 1581 of 2012, Decree 1377 of 2013, Chapter 25 of Decree 1074 of 2015, and other applicable regulations on personal data protection in Colombia.
By visiting our website, contracting our services or interacting with the platform, the data subject acknowledges having read and accepted this policy to the extent applicable to their relationship with nojau.
If you do not agree with the content of this policy, we kindly ask you to refrain from using our services or from providing us with personal data through any channel.
Who is the data controller?
NOJAU S.A.S. is the legal entity responsible for the processing of personal data described in this policy when acting on its own behalf. Its full identification, domicile and contact channels are listed at the end of this document.
Who does this policy apply to?
This policy applies to three groups of data subjects:
- Visitors and prospects: individuals who browse our website, fill out contact forms, request a demo or communicate with us through any channel.
- Clients and their representatives: natural persons who contract nojau services in their own name or on behalf of a legal entity, as well as the administrative users that such persons designate to operate the platform.
- Data subjects whose personal data is processed on behalf of a Client: natural persons — for example, end users who receive WhatsApp messages sent through the platform, buyers of a conversational commerce flow, or individuals interacting with the conversational agent — whose personal data the Client manages using the nojau services. In these cases the Client acts as data controller and nojau as data processor; the specific purposes and legal bases are governed by the Client's own privacy policy.
Definitions
For the purposes of this policy, the definitions of Law 1581 of 2012 apply. Personal data means any information linked or that can be associated with an identified natural person; processing means any operation on personal data such as its collection, storage, use, transfer or deletion; data subject means the natural person whose data is being processed; data controller means the party who decides on the processing; and data processor means the party who processes the data on behalf of the controller.
What personal data do we process?
Depending on how you interact with nojau, we may process the following categories of data:
Visitors and prospects
We process identification and contact data (name, email address, phone number, company you belong to, role) and the content of any communication you voluntarily send us through our website.
Clients and their administrative Users
We process identification and contact data of natural persons linked to the contract (legal representatives, commercial contacts, platform users), billing and payment data — including the information necessary to validate transactions through our providers — platform access credentials, usage logs, and support communications.
Data processed on behalf of a Client
When we act as data processor on behalf of a Client, the data we process is defined exclusively by the Client. It may include identification data, contact data, commercial behavior data, WhatsApp conversation history, transactional data and, in general, any data the Client decides to manage through the contracted services. In these cases nojau does not determine the purposes or the means of the processing: those are defined by the Client.
Sensitive data
nojau does not request nor process special categories of personal data (sensitive data such as health, sexual orientation, political opinions, biometric data or data of minors), except when the Client deliberately uploads them to the platform for a specific purpose. In such cases the Client represents that it has the express authorization of the data subject and the additional legal bases required.
For what purposes do we process your data, and under what legal basis?
As data controller, we process the data of visitors, prospects, Clients and their administrative Users for the following purposes, as applicable:
- Respond to inquiries, demo requests, quotations and any communication you send us through our channels.
- Manage the commercial and contractual relationship: prepare and execute proposals, contracts, billing and collection.
- Operate, maintain and improve the platform, including authentication, technical support, security monitoring and fraud prevention.
- Comply with legal, accounting, tax and regulatory obligations.
- Send commercial information, product updates and educational content when there is prior and express authorization from the data subject, or when an existing contractual relationship is in place and the communication is related to the object of the contract, in accordance with article 5 of Decree 1377 of 2013.
- Retain evidence of interactions for audit and dispute-resolution purposes.
Legal bases supporting these processing activities: Depending on the case, the legal bases supporting these processing activities are: the execution of a contract or pre-contractual measures, compliance with a legal obligation, the data subject's consent for purposes that require it — particularly for marketing communications and for non-strictly-necessary cookies — and nojau's legitimate interest in operating and protecting the integrity of the platform, always balanced against the data subject's rights.
As data processor, we process the data on behalf of the Client, exclusively to provide the contracted services and in accordance with the Client's instructions as established in the contract, the platform configuration, and this policy.
Processing on behalf of our Clients
When a Client uses nojau to manage personal data of its own customers or end users, the relationship is governed by these rules: the Client is the data controller and is therefore responsible for obtaining the necessary authorizations from its data subjects, defining its purposes, handling its data subjects' inquiries and claims, and fulfilling the other obligations that correspond to it as data controller.
nojau's role as data processor
nojau acts as data processor and processes the data solely in accordance with the Client's instructions, the contracted services and this policy. nojau is prohibited from using such data for its own purposes, disclosing it to unauthorized third parties, or retaining it beyond what is necessary to fulfill the engagement.
Data subject rights when processed on behalf of a Client
When a data subject of these processing activities wishes to exercise their rights to know, update, rectify, delete or revoke authorization, they must address their request to the Client acting as data controller. nojau will support the Client in handling these requests within the timeframes and conditions contractually agreed, but will not address the data subject directly except upon the Client's express instruction or a competent authority's requirement.
Data transfers to third parties
To provide the services, nojau shares personal data with a limited number of third parties that act as data processors or sub-processors, under agreements that impose obligations equivalent to those described in this policy and in accordance with article 25 of Decree 1377 of 2013. Among them are:
- Meta Platforms Limited / WhatsApp. Provider of the messaging infrastructure through which broadcasts are delivered, conversations are managed and conversational commerce flows operate.
- OpenAI Ltd.. Provider of the artificial intelligence models used by the platform's conversational agent. Data sent to these models is processed under the provider's conditions and may involve infrastructure located outside Colombia.
- Infrastructure and cloud providers. They host the platform, databases, backups and monitoring services, including providers with data centers in the United States and other regions.
Information security
nojau implements reasonable technical, administrative and organizational measures to protect personal data against unauthorized access, accidental loss, alteration, destruction or improper disclosure. When an incident materially affects the confidentiality, integrity or availability of personal data, nojau will inform the data subjects and the supervisory authority within the timeframes and criteria established by the applicable regulation.
How long do we retain your data?
Personal data processed as controller is retained for the time necessary to fulfill the purpose for which it was collected.
Data processed as processor on behalf of the Client is retained while the contract is in force and, once terminated, for the reasonable period necessary to comply with legal obligations and handle contingencies — unless the Client expressly instructs otherwise.
Minors
nojau's services are aimed at natural persons of legal age engaged in lawful commercial activities. The services are not designed to directly process data of minors. When, upon a Client's instruction, the platform processes data of minors in the context of a training or educational process, the Client represents that it has the authorization of the minor's legal guardian and the specific legal bases required by the applicable regulation, in particular Law 1098 of 2006 and the rules that complement it.
Changes to this policy
nojau may modify this policy to reflect regulatory, operational or service-related changes. The current version will always be published on our website with the update date.
Contact
If you have questions about this Personal Data Processing Policy, you can reach us through the following channels:
- Email: hola@nojau.co
- WhatsApp: +57 305 441 0724
- Legal entity: NOJAU S.A.S. — Colombia