Personal data policy

By ticking the authorisation box on any of our forms, the data subject declares the following:

Under articles 9 and 12 of Colombian Law 1581 of 2012, I authorise AI Safety Colombia to collect, store, use, update, organise and, where needed, share with the processors described in this policy my personal data, in whole or in part, for the purposes this policy describes: reviewing my application, organising the activity and emailing me about it and about other AI Safety Colombia activities, such as events, calls for applications, nomination results and new publications.

I declare that I know my rights as a data subject under article 8 of Law 1581 of 2012, and I give my prior, express and informed consent.

This authorisation lasts as long as those purposes apply and can be revoked at any time, as explained in the section on the data subject's rights.

AI Safety Colombia is a community without legal personhood. That is why the data controller is Jose Angel Gelves Cabrera, the individual who coordinates it, domiciled in Bogotá, Colombia.

For anything to do with your data, write to [email protected]. Enquiries and complaints are handled through that address.

Only what each form asks for, and nothing else:

• Identification and contact: first name, last name, email and, for the sprint, WhatsApp number.
• Profile: a link to LinkedIn, Google Scholar or your CV, field of study, career stage and affiliation.
• Your answers: what you write about your motivation, experience, availability and how you heard about us.
• Other people's data: the name and email of someone you nominate, or the names of your team.
• Logistics: where you will stay, dietary restrictions or accessibility needs, if you choose to share them.
• Proof of your authorisation: the date and time you ticked the box and the version of this policy you accepted.

We don't ask for your ID number, age, gender, ethnicity or address.

• Reviewing your application and deciding who joins each cohort, sprint or activity.
• Writing to you about the activity you applied to: outcome, schedules, materials, changes and certificate.
• Organising logistics: forming groups and teams, arranging lodging, planning food and accessibility.
• Inviting you to future AI Safety Colombia activities related to what you told us. You can ask us to stop at any time.
• Measuring the results of our programmes and reporting them to our funders, always as aggregate figures that don't identify you.

We don't sell your data or use it for advertising.

Information about your health, such as an allergy or an accessibility need, is sensitive data. It is never required: you don't have to give it to apply or to take part. If you do, we use it only to make the activity work for you, and only the organisers see it.

Our programmes are for people over 18. If you are a minor, your parent or legal guardian must authorise the processing of your data before you apply; write to us and we'll sort it out with them.

When you give us another person's name and email, you confirm that you told them you would and that they agreed. We write to them once to invite them, tell them who nominated them if you allowed it, and explain how to ask us to delete their email. If they don't apply within 60 days, we delete it.

If you are selected for a sprint, the other participants can see your name, affiliation, LinkedIn and what you plan to work on, so they can form teams. Your email, WhatsApp and your answers about logistics and health are never published.

The names and photos of the team, mentors and speakers appear on the site with their permission.

Your data is seen only by the people organising the activity you applied to. It is also stored and processed on our behalf by these providers, located in the United States, a country Colombia's Superintendence of Industry and Commerce recognises as having an adequate level of protection (External Circular 005 of 2017, with the criteria restated in External Circular 002 of 2025):

• Supabase: the database where applications are kept.
• Vercel: the site's server and its analytics.
• Resend: sending confirmation emails.
• Google: the team's email, calendar and working documents.

For sprints we run with Apart Research, which organises the global event, we share the name, email and profile of those who confirm attendance so they can be registered. Events are registered on Luma and the community meets on WhatsApp; those services have their own policies.

We keep application data for up to three years after the activity, to measure the results of our programmes and to consider you for future ones. After that we delete or anonymise it. Emails of nominees who don't apply are deleted after 60 days.

As the owner of the data you have the right to:

• Know what data we hold about you, update it and correct it.
• Ask for proof of the authorisation you gave us.
• Know what we have used it for.
• Withdraw your authorisation and ask us to delete it, unless we are legally required to keep it.
• Access it free of charge.
• File a complaint with Colombia's Superintendence of Industry and Commerce, after first making your enquiry or complaint to us.

Write to [email protected] from the email you gave us, with your name, what you are asking for and, if it is a complaint, the facts and any supporting documents.

• Enquiries (what data we hold and how we use it): we reply within 10 business days at most. If we can't, we let you know beforehand and reply within 5 more business days at most.
• Complaints (correction, update, deletion or withdrawal): we reply within 15 business days at most. If we can't, we let you know beforehand and reply within 8 more business days at most. If a complaint is missing information, we ask for it within the next 5 days; if we don't receive it within two months, we consider it withdrawn.

The site doesn't use cookies. We measure visits with Vercel Web Analytics, which counts page views without cookies and without identifying anyone. Forms save a draft in your own browser so you don't lose your progress; it is deleted when you submit and never reaches us. Images for some events load from Luma's servers.

Applications are kept in a database closed to the public, which can only be accessed with a server key. Only the people organising each activity have access, and only to what they need.

This policy applies from 9 October 2026 and the databases will remain in force for as long as AI Safety Colombia operates. If we change it in any important way, such as a new purpose or a new recipient, we will publish it here and email the people who have given us their data.

If you live in Brazil, you also have the rights under Law 13.709 of 2018 (LGPD), and we handle them through the same channel.