1. Definitions
- Personal data: any information linked or that can be associated with one or more identified or identifiable natural persons.
- Data subject: the natural person whose personal data is processed.
- Processing: any operation on personal data, such as its collection, storage, use, transfer or deletion.
- Data controller: LEGALSUITE S.A.S., which decides on the purpose and use of personal data.
- Data processor: a third party that processes personal data on behalf of the Controller, following its instructions.
- Platform: LegalSuite Latam’s legal management software, including its web application and associated services.
- Case file: the set of information, documents and proceedings that the User manages within the Platform to follow up on their legal matters.
- Security incident: an event that compromises the confidentiality, integrity or availability of information.
2. General information
LEGALSUITE S.A.S. (hereinafter, LegalSuite Latam) is a company incorporated under the laws of the Republic of Colombia, with tax ID (NIT) 901.845.808-9 and its principal place of business at Carrera 7 # 71-21 Torre B Oficina 907, Bogotá D.C.
This policy applies to everyone who uses the LegalSuite Latam Platform, whether as a User of a corporate client or as a member of our team with access to the information.
3. Information we collect
- Identification and contact data: name, email address, organization and role within the Platform.
- Case file information: the data and documents you upload to the system to manage your case files and legal procedures, such as proceedings, dates and associated files.
- Basic usage data: logins, general activity on the Platform and, where applicable, the device you connect from. This information lets us support you and detect unusual behavior.
4. Purpose of processing
We use your information only for legitimate purposes related to the service: providing and improving the Platform, giving you technical support, managing notifications and alerts, meeting legal, contractual and regulatory obligations, and telling you about product news when you have authorized it. We do not sell your information or use it for purposes other than those described here.
5. Information security measures
- Role-based access control: each user sees only the information that corresponds to their role and organization. This check happens on our servers, not just on screen, so it does not depend on what the browser shows or hides.
- Secure authentication: sign-in is handled by AWS Cognito, Amazon Web Services’ identity service; we do not store passwords in our own databases. We also offer two-step verification (MFA) for anyone who wants to turn it on as an extra layer of protection.
- Encrypted communication: all information travels between your browser and our servers over a secure connection (HTTPS), so it is not exposed in transit.
- Review before every change: every Platform update goes through automated tests and review by our QA team before it reaches production, to reduce the risk of errors or vulnerabilities.
- Incident management: we have an internal process to detect, contain, investigate and respond to any Security incident, notifying those affected and the competent authorities when the law requires it.
- Team confidentiality: every LegalSuite Latam team member signs confidentiality agreements and accesses client data only when their role requires it, under the principle of least privilege.
We keep improving these controls continuously, in line with Law 1581 of 2012 and international information security best practices.
6. Third parties and data processors
We do not share your data with third parties for commercial purposes unrelated to LegalSuite Latam. We do work with well-known technology providers that act as Data processors to operate the Platform, each under its own security and privacy policies:
- Amazon Web Services (AWS): hosts the Platform and documents, and manages user authentication and identity through AWS Cognito.
- Google and Microsoft: if you choose to sign in with your Google or Microsoft account, we access only the basic profile data these platforms share with our application to identify you: your email address, your name and your profile picture. This is the minimum set of data needed to enable sign-in, and it matches exactly the information Google and Microsoft review and approve in the verification process every production application must pass to use their sign-in services.
- Amazon SES: the Amazon Web Services service we use to send transactional emails, such as Platform invitations and service notifications.
- Stripe: a provider specialized in online payments that we use to process transactions and manage subscription billing. Stripe receives only the data needed to complete the charge and has no access to your case file information.
In every case, we share only the information needed for the service to work properly.
7. Data retention period
We keep your information while your account is active and for as long as legal, contractual or legal-defense obligations require it. When it is no longer needed for these purposes, we delete or anonymize it, following the procedures in force at the time.
8. Rights of the data subject
As the Data subject of your personal data, you have the right to:
- Access, update and correct your information.
- Request proof of the authorization you granted.
- Be informed about how we use your data.
- Revoke your authorization and, where appropriate, request the deletion of your data.
- File complaints with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio) for violations of data protection regulations.
You can exercise these rights free of charge by writing to contacto@legalsuitelatam.com.
9. Support and incident reporting procedure
If you notice suspicious behavior, a possible Security incident or have questions about how your data is handled, write to us at contacto@legalsuitelatam.com. We handle these reports as a priority and within the time frames set by applicable regulations.
10. Governing law
This policy is governed by the Political Constitution of Colombia (Article 15), Law 1581 of 2012, Decree 1377 of 2013 and other applicable Colombian regulations on personal data protection and information security. Any dispute related to this policy will be resolved before the judges of the Republic of Colombia.
11. Validity and updates
We may update this policy when necessary, for example due to changes in our services, in applicable regulations or in our security controls. You will always find the current version here, with the date of the last update.