Your privacy rights

Write to the privacy email in the identification record with the subject “Personal data request”. Include your name, a reply contact, your account or relationship with Oruka, the right you wish to exercise and a clear description. Explain your authority if representing someone else.

Identity verification will be proportionate to risk. Do not initially send identity-document copies, passwords, API keys or full card details. If further information is needed, we will explain what and why. Exercising rights is free except costs or exceptions expressly allowed by law.

You may know, update and correct your data; access it free of charge; request evidence of authorization except where legally exempt; learn how it is used; revoke authorization or request deletion where available; and complain to the Superintendencia de Industria y Comercio (SIC). Revocation and deletion may be restricted by legal or contractual retention duties.

Inquiries are answered within ten business days of receipt. If an answer is not possible within that time, reasons and a new date will be communicated before the deadline; the extension may not exceed five additional business days.

Claims for correction, updating, deletion or potential noncompliance are answered within fifteen business days starting the day after receipt. If an extension is required, reasons and a date will be provided before expiry, for up to eight additional business days.

For an incomplete claim, missing information will be requested within five days. If it is not supplied within two months of that request, the claim is treated as withdrawn. An incompetent recipient will forward it to the appropriate party within two business days and notify you. A complete claim is marked “claim in progress” in the relevant database within two business days until resolved.

Before filing a data-protection complaint with the SIC, the inquiry or claim procedure with the controller or processor must first be exhausted as required by law. Official channels are available at www.sic.gov.co.

For data in a business's conversation, form or campaign, initially contact that business, which determines the purposes. If you contact Oruka, we will identify the case and cooperate or forward the request where appropriate, without disclosing other customers' data. A Oruka account is not required to exercise your rights.

Depending on your country and its law's scope, additional rights may include access, correction, cancellation, objection, portability or review of automated decisions. Tell us your country so the appropriate procedure and deadline can be applied. These pages do not limit recourse to your local data-protection or consumer authority.

Where a state privacy law applies to Oruka and your request, rights may include knowing, accessing, correcting, deleting, obtaining a portable copy and opting out of certain uses, such as sale, sharing for targeted advertising or some profiling. Appeals and authorized-agent requests may also be available.

Oruka is not presumed to meet every state law's thresholds. Where the CCPA/CPRA applies, access, correction and deletion requests are generally answered within 45 calendar days, subject to lawful extensions and notice. Denials will include reasons and available appeal procedures. We do not discriminate for exercising legally protected rights.

Our integration does not sell data or share it for cross-context behavioral advertising. Global Privacy Control disables optional analytics in this browser even after an earlier affirmative choice.

If processing is subject to the GDPR, you may exercise access, rectification, erasure, restriction, portability and objection subject to their requirements; withdraw consent without affecting earlier lawful processing; and complain to a competent supervisory authority. Where applicable, you have protections against solely automated decisions with legal or similarly significant effects.

Requests are answered without undue delay and normally within one month. Complexity or volume may justify up to two additional months, with notice within the first month. Operating from Colombia or receiving a visit from Europe does not by itself make the entire service subject to the GDPR.

Change or withdraw optional analytics through Cookies and preferences or the privacy policy. Rejecting analytics does not delete your account. Account deletion does not necessarily remove records subject to legal retention; we will explain the scope and restrict use where required.

Account and data requests use the published contact; this page does not automatically delete data or simulate submission of a form. If the contact email is still marked incomplete, the operator must configure it before publishing the service.