{"id":3006,"date":"2026-02-04T16:51:14","date_gmt":"2026-02-04T16:51:14","guid":{"rendered":"https:\/\/tumipay.com\/?page_id=3006"},"modified":"2026-09-07T02:29:57","modified_gmt":"2026-09-07T02:29:57","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/tumipay.com\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"<div data-elementor-type=\"wp-page\" data-elementor-id=\"3006\" class=\"elementor elementor-3006 elementor-3\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ee0740e e-flex e-con-boxed e-con e-parent\" data-id=\"ee0740e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-387684d e-flex e-con-boxed e-con e-parent\" data-id=\"387684d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-005d733 elementor-widget__width-inherit elementor-widget elementor-widget-text-editor\" data-id=\"005d733\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p> <\/p><div style=\"font-family: 'Roboto', Arial, sans-serif; color: #2b1550; max-width: 860px; margin: 0 auto; line-height: 1.65;\"><p><\/p><div style=\"background: linear-gradient(135deg,#2D0A5C 0%,#5B21B6 60%,#7C3AED 100%); border-radius: 14px; padding: 32px 36px; margin-bottom: 32px; color: #ffffff;\"><p style=\"text-transform: uppercase; letter-spacing: 2px; font-size: 13px; color: #d8b4fe; margin: 0 0 8px 0; font-weight: 600;\">TumiPay \u00b7 Legal Document<\/p><h1 style=\"font-size: 32px; margin: 0 0 12px 0; font-weight: 800; color: #ffffff;\">Privacy Policy<\/h1><p style=\"margin: 0; font-size: 14px; color: #ede4ff;\">Code: LEG-POL-03 | Version: 01 | Effective: 12\/31\/2027 | Application start date: September 1, 2026<\/p><\/div><p><\/p><p style=\"font-size: 16px;\">The TumiPay group, comprising <strong>TUMIPAY S.A.S.<\/strong>, <strong>TumiPay S.A.C. (Peru)<\/strong>, and <strong>TumiPay S.A.P.I. DE C.V. (Mexico)<\/strong> (hereinafter, \u201cTumiPay\u201d or \u201cwe\u201d), establishes this Privacy Policy to ensure the protection, security, and confidentiality of the personal information of its clients, users, affiliated merchants, suppliers, partners, and other third parties.<\/p><p style=\"font-size: 16px;\">This policy governs the collection, storage, use, circulation, and deletion of personal data within the framework of TumiPay\u2019s activities as a payment service provider, and applies primarily in Colombia, Peru, and Mexico in accordance with the legislation of each country and, subsidiarily, in new jurisdictions where the TumiPay group operates. The organization also incorporates international best practices in privacy and information security, referencing standards such as the European Union\u2019s General Data Protection Regulation (GDPR), to the extent compatible with local regulations. <\/p><hr style=\"border: none; border-top: 2px solid #E9D8FD; margin: 32px 0;\"><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">1. Principles<\/h2><p>The processing of personal data by TumiPay is governed by the following principles:<\/p><ul style=\"padding-left: 22px;\"><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Legality:<\/strong> data processing is carried out in strict compliance with applicable data protection regulations in each country.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Purpose:<\/strong> data collection and use is limited to legitimate, explicit purposes previously disclosed to the data subject.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Freedom:<\/strong> processing is only carried out with the prior, express, and informed consent of the data subject, except in cases authorized by law.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Accuracy or quality:<\/strong> information provided must be truthful, complete, accurate, up-to-date, verifiable, and understandable.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Transparency:<\/strong> the data subject is guaranteed access to their information and the ability to know how it is being used.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Restricted access and circulation:<\/strong> data processing is carried out within the limits of regulations and with access only by authorized persons.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Security:<\/strong> necessary technical, human, and administrative measures are implemented to protect personal data against loss, alteration, misuse, or unauthorized access.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Confidentiality:<\/strong> all persons involved in data processing are obligated to ensure the confidentiality of information, even after their relationship with TumiPay has ended.<\/li><\/ul><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">2. Definitions<\/h2><ul style=\"padding-left: 22px;\"><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Authorization:<\/strong> prior, express, and informed consent of the data subject for the processing of their personal data.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Database:<\/strong> organized set of personal data.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Personal Data:<\/strong> any information linked to or that can be associated with a specific or identifiable natural person.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Sensitive Data:<\/strong> information that affects the privacy of the data subject or whose misuse may generate discrimination, including biometric data.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Data Processor:<\/strong> person or entity that processes personal data on behalf of the controller.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Data Controller:<\/strong> person or entity that decides on the database and\/or the processing of personal data.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Data Subject:<\/strong> natural person whose personal data is subject to processing.<\/li><li style=\"margin-bottom: 10px;\"><strong style=\"color: #5b21b6;\">Data Processing:<\/strong> any operation on personal data: collection, storage, use, circulation, or deletion.<\/li><\/ul><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">3. Scope of Application<\/h2><p>This policy applies to clients, users, affiliated merchants, suppliers, and strategic partners who interact with TUMIPAY S.A.S. (Colombia), TUMIPAY S.A.C. (Peru), or TUMIPAY S.A.P.I. DE C.V. (Mexico), or any company belonging to the TumiPay group in new jurisdictions.<\/p><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">4. Applicable Regulatory Framework<\/h2><div style=\"background: #F5F0FF; border-radius: 10px; padding: 18px 22px; margin-bottom: 14px;\"><p style=\"margin: 0;\"><strong style=\"color: #5b21b6;\">Colombia:<\/strong> Political Constitution, articles 15, 16, and 20; Law 1266 of 2008; Law 1581 of 2012; Decrees 1727 of 2009, 1377 of 2013, and 886 of 2014; External Circulars 02 of 2015 and 001 of 2016 of the Superintendence of Industry and Commerce (SIC).<\/p><\/div><div style=\"background: #F5F0FF; border-radius: 10px; padding: 18px 22px; margin-bottom: 14px;\"><p style=\"margin: 0;\"><strong style=\"color: #5b21b6;\">Peru:<\/strong> Law No. 29733, Personal Data Protection Law, and its Regulation (Supreme Decree No. 016-2024-JUS); provisions of the National Authority for the Protection of Personal Data (ANPDP).<\/p><\/div><div style=\"background: #F5F0FF; border-radius: 10px; padding: 18px 22px; margin-bottom: 14px;\"><p style=\"margin: 0;\"><strong style=\"color: #5b21b6;\">Mexico:<\/strong> Federal Law on the Protection of Personal Data Held by Private Parties and its Regulation; provisions of the Secretariat of Anti-Corruption and Good Governance.<\/p><\/div><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">5. Processing of Personal Data and Its Purpose<\/h2><p>The personal data of clients, users, suppliers, and partners will be collected, stored, processed, analyzed, shared, and used for the following purposes, among others:<\/p><ul style=\"padding-left: 22px;\"><li style=\"margin-bottom: 8px;\">Provision of financial and transactional services.<\/li><li style=\"margin-bottom: 8px;\">Identity verification, document validation, and fraud prevention.<\/li><li style=\"margin-bottom: 8px;\">Compliance with legal and regulatory requirements, including prevention of money laundering and terrorist financing, and reporting to competent authorities.<\/li><li style=\"margin-bottom: 8px;\">Administration and monitoring of payment operations, ensuring security, traceability, and legality of transactions.<\/li><li style=\"margin-bottom: 8px;\">Assessment and management of technological, operational, and information security risks.<\/li><li style=\"margin-bottom: 8px;\">Contact with clients and users for informational, educational, or commercial campaigns, within the limits of the authorization granted.<\/li><li style=\"margin-bottom: 8px;\">Development, innovation, and improvement of products and services through data analysis, with anonymization or pseudonymization mechanisms where applicable.<\/li><li style=\"margin-bottom: 8px;\">Management and supervision of suppliers and partners, including due diligence processes.<\/li><li style=\"margin-bottom: 8px;\">Transfer and transmission of personal data to third-party partners, domestic or international, when necessary for the provision of services.<\/li><\/ul><p>TumiPay maintains a clear, public, and transparent policy on the processing of personal data and sensitive information, aligned with data protection and consumer protection regulations in each country where it operates (in Colombia, the SIC; in Peru, the ANPDP and INDECOPI; in Mexico, the Secretariat of Anti-Corruption and Good Governance and PROFECO). Evidence of consent granted by data subjects through our digital channels is retained for a minimum period of ten (10) years. <\/p><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">6. Processing of Sensitive Data<\/h2><p>TumiPay may process sensitive data, including biometric data (images, fingerprints, voice, and others that may be captured in authentication processes), only with prior, express, and informed authorization from the data subject, in cases such as:<\/p><ul style=\"padding-left: 22px;\"><li style=\"margin-bottom: 8px;\">Security and enhanced authentication of users in payment operations.<\/li><li style=\"margin-bottom: 8px;\">Compliance with fraud prevention, money laundering, and terrorist financing regulations.<\/li><li style=\"margin-bottom: 8px;\">Identity verification in financial operations requiring enhanced validations.<\/li><li style=\"margin-bottom: 8px;\">Access control and security at physical facilities and computer systems.<\/li><\/ul><p>The processing of sensitive data will be exceptional and proportionate. TumiPay will not condition access to its services on the provision of sensitive data, unless such data is essential to ensure the security of the operation. Advanced technical controls such as encryption, database segmentation, access traceability, and audit logs will be applied. In international transfers of sensitive data, TumiPay will ensure compliance with local regulations and, where applicable, international standards such as GDPR.   <\/p><p>The provision of sensitive data is optional. Refusal to authorize it will not limit access to the services offered, except when such information is strictly necessary to validate identity or ensure the security of the operation. <\/p><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">7. Access to Sensitive Personal Data<\/h2><p>Access to databases containing sensitive information is strictly restricted to previously authorized personnel with functions directly related to its processing. To this end, TumiPay applies: <\/p><ul style=\"padding-left: 22px;\"><li style=\"margin-bottom: 8px;\">Two-factor authentication (2FA) mechanisms for all access.<\/li><li style=\"margin-bottom: 8px;\">Audit logs of each access, query, or modification, including user, date, time, and operation performed.<\/li><li style=\"margin-bottom: 8px;\">Principle of least privilege in the assignment of permissions.<\/li><li style=\"margin-bottom: 8px;\">Confidentiality protocols and agreements for all personnel with access to this information.<\/li><\/ul><p>Failure to comply with these measures will result in applicable internal sanctions and, in the case of third parties, suppliers, or partners, TumiPay may immediately suspend or terminate the corresponding commercial or contractual relationship, without prejudice to applicable civil or criminal legal actions.<\/p><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">8. Rights of the Data Subject<\/h2><p>In accordance with current regulations, data subjects have the following rights:<\/p><ul style=\"padding-left: 22px;\"><li style=\"margin-bottom: 8px;\">Know, update, and rectify their personal data with TumiPay, in its capacity as data controller.<\/li><li style=\"margin-bottom: 8px;\">Request proof of the authorization granted for the processing of their data.<\/li><li style=\"margin-bottom: 8px;\">Be informed about the use that has been made of their personal data.<\/li><li style=\"margin-bottom: 8px;\">File complaints with the competent data protection authority in their country (in Colombia, the SIC; in Peru, the ANPDP; in Mexico, the Secretariat of Anti-Corruption and Good Governance).<\/li><li style=\"margin-bottom: 8px;\">Revoke authorization and\/or request deletion of their data when principles, rights, and legal guarantees are not respected.<\/li><li style=\"margin-bottom: 8px;\">Access their personal data free of charge.<\/li><li style=\"margin-bottom: 8px;\">Receive timely responses to their inquiries and complaints within the legally established timeframes.<\/li><\/ul><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">9. Procedures for Exercising Data Subject Rights<\/h2><p>Data subjects may submit inquiries and complaints through the channels indicated in the Contact section. Response timeframes are as follows: <\/p><table style=\"width: 100%; border-collapse: collapse; margin: 18px 0;\"><tbody><tr style=\"background: #5B21B6; color: #ffffff;\"><th style=\"padding: 12px 16px; text-align: left; border-radius: 8px 0 0 0;\">Type of request<\/th><th style=\"padding: 12px 16px; text-align: left; border-radius: 0 8px 0 0;\">Response timeframe<\/th><\/tr><tr style=\"background: #F5F0FF;\"><td style=\"padding: 12px 16px; border-bottom: 1px solid #E9D8FD;\">Inquiries<\/td><td style=\"padding: 12px 16px; border-bottom: 1px solid #E9D8FD;\">Up to 10 business days<\/td><\/tr><tr><td style=\"padding: 12px 16px;\">Complaints<\/td><td style=\"padding: 12px 16px;\">Up to 15 business days, with possible extension in justified cases<\/td><\/tr><\/tbody><\/table><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">10. Accuracy, Quality, and Validation of Data<\/h2><p>All personal data processed by TumiPay must be truthful, complete, accurate, up-to-date, verifiable, and understandable. The registration and disclosure of partial, incomplete, or misleading data is prohibited. TumiPay implements validation procedures\u2014verification of data types, formats, relevance and consistency, and duplicate controls\u2014and conducts periodic purges and audits of its databases to minimize errors and inconsistencies.  <\/p><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">11. Procedures for Revocation and Deletion of Data<\/h2><p>Data subjects may request deletion of their personal data when: (i) it is not processed in accordance with current legislation; (ii) it is no longer necessary for the established purposes; or (iii) the maximum retention period has been met. TumiPay has electronic and physical mechanisms for receiving and processing these requests.    <\/p><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">12. Registration with Authorities<\/h2><p>In Colombia, TumiPay is registered in the National Database Registry (RNBD) and complies with update and reporting requirements to the Superintendence of Industry and Commerce, including reporting incidents that affect the confidentiality, integrity, or availability of personal data. In Peru and Mexico, TumiPay complies with registrations, authorizations, and reports required by the National Authority for the Protection of Personal Data and applicable Mexican regulations, respectively. <\/p><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">13. Information Security<\/h2><p>TumiPay implements technical, human, administrative, and organizational measures to protect personal data against loss, alteration, misuse, or unauthorized access, including encryption, access controls, enhanced authentication, backup copies, and continuous monitoring. When TumiPay delegates data processing to third parties, they must guarantee equivalent security measures through contractual confidentiality clauses and periodic audits. Full details of these controls and the obligations of third parties, clients, and partners regarding information security are found in our Information Security Terms and Conditions, a document that forms an integral part of TumiPay\u2019s relationship with its clients, suppliers, and partners.  <\/p><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">14. Data Controller and Policy Governance<\/h2><p>TumiPay has an internal data controller and an Information Security Committee responsible for periodically reviewing this policy, evaluating its effectiveness, and supporting the management of risks associated with personal data processing.<\/p><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">15. Non-Compliance and Consequences<\/h2><p>Non-compliance with this Privacy Policy by clients, users, suppliers, or partners\u2014including misuse of personal data or violation of the security measures described herein\u2014will authorize TumiPay to immediately suspend or terminate, without liability to TumiPay, the corresponding commercial, contractual, or partnership relationship, without prejudice to applicable civil, criminal, or administrative legal actions.<\/p><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">16. Contact<\/h2><div style=\"background: linear-gradient(135deg,#F5F0FF 0%,#EDE4FF 100%); border-radius: 10px; padding: 20px 24px;\"><p style=\"margin: 0 0 8px 0;\"><strong style=\"color: #5b21b6;\">Email:<\/strong> <a style=\"color: #7c3aed; text-decoration: none;\" href=\"mailto:seguridad@tumipay.com\">seguridad@tumipay.com<\/a><\/p><p style=\"margin: 0;\"><strong style=\"color: #5b21b6;\">Website:<\/strong> <a style=\"color: #7c3aed; text-decoration: none;\" href=\"https:\/\/tumipay.com\/en\/\">www.tumipay.com<\/a><\/p><\/div><p><\/p><h2 style=\"color: #5b21b6; font-size: 22px; border-left: 5px solid #7C3AED; padding-left: 14px; margin-top: 36px;\">17. Effective Date and Modifications<\/h2><p>This policy takes effect from its publication and will remain in force as long as the commercial or legal relationship with the data subject is maintained. Any substantial changes will be communicated through our website, with the date of the new version. <\/p><p><\/p><div style=\"text-align: center; margin-top: 44px; padding-top: 24px; border-top: 2px solid #E9D8FD;\"><p style=\"color: #7c3aed; font-weight: bold; font-size: 15px; margin: 0;\">Global payments, <span style=\"color: #2d0a5c;\">unlimited connections<\/span><\/p><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>TumiPay \u00b7 Legal Document Privacy Policy Code: LEG-POL-03 | Version: 01 | Effective: 12\/31\/2027 | Application start date: September 1, 2026 The TumiPay group, comprising TUMIPAY S.A.S., TumiPay S.A.C. (Peru), and TumiPay S.A.P.I. DE C.V. (Mexico) (hereinafter, &#8220;TumiPay&#8221; or &#8220;we&#8221;), establishes this Privacy Policy to ensure the protection, security, and confidentiality of the personal information [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_seopress_titles_title":"Privacy Policy | TumiPay","_seopress_titles_desc":"","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","content-type":"","footnotes":""},"class_list":["post-3006","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/tumipay.com\/en\/wp-json\/wp\/v2\/pages\/3006","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tumipay.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/tumipay.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/tumipay.com\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/tumipay.com\/en\/wp-json\/wp\/v2\/comments?post=3006"}],"version-history":[{"count":4,"href":"https:\/\/tumipay.com\/en\/wp-json\/wp\/v2\/pages\/3006\/revisions"}],"predecessor-version":[{"id":4161,"href":"https:\/\/tumipay.com\/en\/wp-json\/wp\/v2\/pages\/3006\/revisions\/4161"}],"wp:attachment":[{"href":"https:\/\/tumipay.com\/en\/wp-json\/wp\/v2\/media?parent=3006"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}