Personal data processing policy

This English version is provided for your convenience. The official version is the Spanish one at /politica-de-datos/; if there is any discrepancy, the Spanish version prevails.

1. Data controller

The controller of your data is Gastrup Marketing LLC ("Gastrup"), a limited liability company formed in the state of Wyoming, United States, on March 31, 2025, with registration number 2025-001646406 with the Wyoming Secretary of State. Address: 30 N Gould St, Ste N, Sheridan, WY 82801, Estados Unidos.

"Gastrup Marketing" is the brand under which Gastrup Marketing LLC provides its services. The team works from Medellín, Colombia.

Email for personal data matters: hello@gastrupmarketing.com. Phone and WhatsApp: +57 333 2260396.

This policy is issued in compliance with Colombian Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Single Decree 1074 of 2015) and any other rules that amend or supplement them.

2. Data we collect

• Contact data: name, WhatsApp number and email address.
• Business data: name, type of business, country, city, Instagram profile and website.
• Commercial information you share: average check range and monthly revenue range. If you write to us on WhatsApp or email, also what you tell us in that conversation.
• Browsing and attribution data: campaign parameters (UTM), ad click identifiers (for example gclid or fbclid), landing page and referring page. They are stored in your browser for up to 90 days and sent along with the form.
• Analytics and advertising data: if you accept them in the cookie notice, Google Analytics 4 and the Meta pixel record how you use the site (page views, clicks, form submissions) with identifiers from your browser. See section 9.
• Public information about the restaurant: posts, reviews and profiles on social networks, Google and other public sites.

We do not request sensitive data or data of children or adolescents. About your sales we only ask for a monthly revenue range; we do not ask for margins or costs.

3. Purposes

• Prepare the diagnosis you request and contact you by WhatsApp, email or phone to talk about it and, only if you accept it in a separate checkbox, to send you WhatsApp reminders about that diagnosis.
• If after the diagnosis you decide to keep talking, send you a proposal for Gastrup services.
• Provide the contracted services, invoice and manage the relationship with clients.
• Measure the performance of our campaigns and of this website.
• Prevent fraud and spam in our forms.
• Comply with legal, accounting and tax obligations.

The data you send for the diagnosis

The data you send us in the diagnosis form is used only to prepare your diagnosis and contact you about it and, only if you accept it in a separate checkbox, to send you WhatsApp reminders about that diagnosis. It is not shared with third parties or used for any other purpose. Only the providers we need to operate the service have access to it (website hosting, email and WhatsApp to write to you, our internal management platform, the tools we use to prepare the diagnosis and, if you accept it in the cookie notice, the analytics that records the form submission; see section 5), under confidentiality and following our instructions. The campaign parameters that travel with the form (section 2) let us know which ad or channel your request came from, and the form’s anti-spam check protects that same submission.

4. Use of artificial intelligence

To prepare the diagnosis we use artificial intelligence tools that process the information you send us and public information about your restaurant (for example, social networks, reviews and Google listings), in order to identify marketing opportunities. The diagnosis is generated automatically and, when appropriate, the Gastrup team may review it. We do not make decisions with legal effects on you based solely on automated processing.

The AI tools may be provided by third parties located outside Colombia, acting as data processors under our instructions. We do not authorize those providers to use your data for their own purposes.

5. Processors and transfers

For the purposes above we share data with providers acting as data processors:

• Hostinger: hosting of the website and the form.
• Google: Google Tag Manager and Google Analytics 4 (site analytics), Google Ads (campaign measurement, when we use them) and Google Workspace (email).
• Meta: Meta pixel to measure campaigns on Facebook and Instagram (we are adding it through Google Tag Manager) and WhatsApp to talk with you.
• Gastrup’s internal commercial management platform (CRM), where we record requests.
• Artificial intelligence providers that we use to prepare the diagnosis (see section 4).

Some of these providers are in other countries, such as the United States. They only process the data under our instructions and with adequate security measures.

Apart from these providers, which we need to operate the service and which process the data under confidentiality, your data is not shared with third parties or used for any purpose other than those described in this policy.

6. Rights of the data subject

As the data subject you have the right to:

• Know, update and rectify your personal data.
• Request proof of the authorization you gave us.
• Be informed about the use we make of your data.
• File complaints with the Colombian Superintendence of Industry and Commerce (SIC) for violations of the law, once the inquiry or complaint process with Gastrup has been exhausted.
• Revoke the authorization or request deletion of your data when there is no legal or contractual duty to keep it.
• Access, free of charge, your personal data that is being processed.

7. How to exercise your rights

Write to hello@gastrupmarketing.com with your name, ID document, a description of your request and a way to reply.

• Inquiries: answered within a maximum of ten (10) business days from receipt. If that is not possible, we will tell you why and the new date, which will not exceed five (5) additional business days.
• Complaints (correction, update, deletion or breach): handled within a maximum of fifteen (15) business days from receipt, extendable by up to eight (8) more business days, with prior notice of the reason.

8. Retention and security

We keep data for the time needed for the purposes described and to comply with legal obligations. Data from diagnosis requests that do not become clients is kept only while it is useful for that purpose, and you can ask for its deletion at any time; after that it only remains in aggregated and anonymous form. We apply reasonable technical and administrative measures to protect the information against loss, unauthorized access or misuse.

9. Cookies and local storage

We use Google Tag Manager and Google Analytics 4 to understand how the site is used, and we are adding the Meta pixel (through Google Tag Manager) to measure our campaigns. These tools only store analytics or advertising cookies if you accept them in the cookie notice; if you reject them, they work in restricted mode, without those cookies (Google Consent Mode).

• Analytics (Google Analytics 4): cookies _ga and _ga_*, up to 2 years.
• Advertising (Meta pixel): cookies _fbp and _fbc, up to 90 days.
• Necessary (browser local storage): your cookie choice and the campaign parameters (UTM and similar) for up to 90 days, to know which ad or channel a request came from.

You can change your choice at any time with the “Cookie preferences” link at the bottom of the page, or by clearing the site data in your browser.

10. Changes to this policy

We may update this policy. We will publish the new version on this page with its date. If the change affects the purposes, we will let you know and ask for a new authorization when the law requires it.