Cundasia's services are operated by two related entities that act jointly as data controllers:
Global parent entity
Owner of global brands CUNDASIA®, CHSP™ and El Portal Vivo™. Data controller for users outside Colombia, especially for users in the European Union (GDPR), United Kingdom and United States (CCPA).
Operating entity in Colombia
Executes all operations in Colombia: CHSP service delivery, El Portal Vivo, Cundasia Music™, Cundasia Meditations, online store and OHS consulting. Data controller for users in Colombia under Law 1581 of 2012.
If you are a user in Colombia, your data is processed primarily by Cundasia Colombia S.A.S. under Law 1581 of 2012. If you are a user in Europe, the UK or the USA, the primary controller is Cundasia Global Holding PBC under GDPR or CCPA as applicable. In all cases, the single privacy contact is legal@cundasia.com.
This Privacy Policy applies to all products and services in the Cundasia ecosystem: El Portal Vivo (wellness app), CHSP (B2B organizational mental health platform under ISO 45003), Cundasia Music™, Cundasia Meditations, the online store and the website cundasia.com.
We collect only the data necessary to provide our services:
| Category | Specific data | Source |
|---|---|---|
| Identification | Full name, email address, country of residence | Registration / form |
| Payment data | Card information (processed by secure third parties — Stripe/PayPal). Cundasia does NOT store card numbers. | Transaction |
| App usage | Completed sessions, accessed modules, frequency of use, practice progress | Automatic |
| Device data | Device type, operating system, IP address, system language | Automatic |
| Companies (CHSP) | Company name, sector, number of employees, HR/OHS contact details | B2B contract |
| Communications | WhatsApp messages, support emails, contact forms | The user |
Cundasia does not collect sensitive data such as health information, religious beliefs, sexual orientation or biometric data through its platforms. Wellness programs are voluntary and practice data is anonymized in business reports.
We use your data exclusively for the following purposes:
- Service delivery: Create and manage your account, personalize your experience in El Portal Vivo or CHSP, and deliver products or services purchased in the store.
- Payment processing: Manage transactions securely through certified payment processors.
- Support and communication: Respond to inquiries, resolve technical issues and send relevant information about your subscription.
- Product improvement: Analyze usage patterns (in aggregate and anonymous form) to improve our platforms.
- Legal compliance: Meet fiscal, accounting and regulatory obligations applicable in Colombia and the countries where we operate.
- Marketing communications: Send you relevant content about our products and services only if you have given your express consent. You can revoke this consent at any time.
Cundasia's processing of personal data is based on the following legal grounds:
| Legal basis | Application |
|---|---|
| Consent (Art. 6.1.a GDPR / Law 1581 Art. 9) | App registration, marketing communications, non-essential cookies |
| Contract performance (Art. 6.1.b GDPR / Colombian Commercial Code) | Service delivery, payment processing, product delivery |
| Legal obligation (Art. 6.1.c GDPR / Colombian tax laws) | Invoicing, accounting records, regulatory reports |
| Legitimate interest (Art. 6.1.f GDPR) | Product improvement (anonymous data), platform security, fraud prevention |
Cundasia works with trusted technology service providers. We never sell your data to third parties under any circumstances.
| Provider | Purpose | Country |
|---|---|---|
| GoDaddy | Website hosting | USA |
| Stripe / PayPal | Payment processing | USA / Luxembourg |
| Apple App Store | iOS app distribution and subscription processing | USA |
| Google Play | Android app distribution and subscription processing | USA |
| DistroKid | Distribution of Cundasia Music™ on streaming platforms | USA |
| WhatsApp Business | Customer service and support | USA |
| n8n / Make | Internal workflow automation | EU / USA |
| EmailJS | Contact form delivery | USA |
Some of our providers process data outside Colombia. In all cases, we ensure that these providers have adequate data protection mechanisms (Standard Contractual Clauses, Privacy Shield or equivalents), in accordance with Decree 1377 of 2013 and the GDPR.
| Data type | Retention period |
|---|---|
| Active account data | While the account is active |
| Data after cancellation | 30 days (then permanent deletion, unless legally required) |
| Accounting and billing records | 10 years (Colombian legal requirement) |
| Support data | 2 years from last interaction |
| Anonymous usage data | Indefinite (contain no personal data) |
As a data subject, you have the following rights that you can exercise at any time by writing to legal@cundasia.com. We will respond within 15 business days of your request.
- Access: Know what personal data we have stored about you and how we use it.
- Rectification: Correct inaccurate, incomplete or outdated data.
- Erasure: Request deletion of your data when it is no longer necessary for the purpose for which it was collected (right to be forgotten).
- Objection: Object to the processing of your data for marketing purposes or when processing is based on legitimate interest.
- Portability (GDPR): Receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller.
- Restriction: Request that we temporarily suspend processing of your data in certain circumstances.
- Withdrawal of consent: Withdraw your consent at any time, without affecting the lawfulness of prior processing.
If you believe we have violated your rights:
🇨🇴 Colombia: Superintendencia de Industria y Comercio (SIC) — www.sic.gov.co
🇪🇺 European Union: Your country's data protection authority (see EDPB directory)
🇬🇧 United Kingdom: Information Commissioner's Office — ico.org.uk
🇺🇸 USA (Delaware/California): Attorney General of your state
We implement appropriate technical and organizational measures to protect your personal data against loss, unauthorized access, disclosure, alteration or destruction:
- SSL/TLS encryption on all communications between the app/web and our servers.
- Encrypted storage of passwords and sensitive data.
- Restricted access: Only authorized Cundasia staff have access to personal data, under confidentiality agreements.
- PCI-DSS certified payment processors: Cundasia does not store credit card data.
- Periodic security audits and system updates.
In the event of a security breach affecting your data, we will notify you within 72 hours of detection, in accordance with the GDPR and applicable Colombian regulations.
Our website uses cookies to improve your experience. We classify them into three categories:
| Type | Description | Requires consent? |
|---|---|---|
| Essential | Necessary for basic site functionality (session, language/currency preferences) | No |
| Analytics | Help us understand how the site is used (pages visited, time on site). Anonymized data. | Yes |
| Marketing | Used to show relevant content. Only activated with your express consent. | Yes |
You can manage or delete cookies from your browser settings at any time. By continuing to browse our site without rejecting them, you accept the use of essential cookies.
Cundasia's services are intended for people over 18 years of age. We do not intentionally collect personal data from minors. If you are a parent or guardian and believe your child under 18 has provided us with personal data, contact us at legal@cundasia.com and we will delete it immediately.
We may update this Privacy Policy periodically to reflect changes in our practices, offered services or applicable legal requirements. When we make significant changes:
- We will notify you by email if you have an active account.
- We will display a prominent notice in our application and website.
- The effective date of the updated policy will appear clearly in the header.
Continued use of our services after notification implies your acceptance of the updated policy.
To exercise your rights, file a complaint or make any inquiry related to the processing of your personal data, you can contact us through any of the following channels:
This policy is drafted in accordance with: Law 1581 of 2012 (Cundasia Colombia S.A.S.) · Decree 1377 of 2013 · GDPR (EU) 2016/679 (Cundasia Global Holding PBC) · CCPA (Delaware / California, USA) · Delaware General Corporation Law