Privacy Policy
Last updated: February 2026
TruePath Investments (“TruePath,” “we,” “us” or “our”) respects the privacy of individuals who visit our website, communicate with us or otherwise provide personal data to us.
This Privacy Policy describes how TruePath collects, uses, stores, shares and protects personal data in connection with this website and related communications.
Personal data is processed in accordance with applicable data protection laws, including Colombia’s Law 1581 of 2012 and its applicable regulatory provisions.
1. Data Controller
The data controller responsible for the processing of personal data covered by this Privacy Policy is:
TruePath Investments S.A.S.
Bogotá D.C., Republic of Colombia
For privacy-related inquiries or requests:
2. Personal Data We May Collect
Depending on how you interact with TruePath and this website, we may collect the following categories of personal data:
Identification and contact information, such as your name, email address, telephone number, country or territory, organization, professional position and other contact details you voluntarily provide.
Professional and institutional information, such as your organization, professional role, institutional affiliation and the nature of your interest in contacting TruePath.
Information submitted through communications, including information contained in inquiries, correspondence, contact forms or other communications you voluntarily provide to us.
Technical and browsing information, which may include IP address, browser type, device information, operating system, pages visited, access times, referring URLs and other technical information generated when accessing or using the website.
Cookie and similar technology data, where applicable, in accordance with the technologies implemented on the website and the choices available to users.
We seek to collect only personal data that is relevant and reasonably necessary for the purposes for which it is processed.
3. How We Collect Personal Data
We may collect personal data:
directly from you when you submit an inquiry, contact TruePath, complete a website form or otherwise communicate with us;
automatically through your interaction with the website and its underlying technologies; and
where legally permitted, from counterparties, service providers, professional or institutional sources, or publicly available sources in connection with legitimate business activities.
Submission of personal data through our website is generally voluntary. However, certain information may be necessary for us to respond to an inquiry or process a request.
4. Purposes of Processing
TruePath may process personal data for purposes including:
operating, maintaining, securing and improving this website;
responding to inquiries and communications;
evaluating the nature and relevance of potential institutional, strategic or business relationships;
managing communications with institutional investors, asset owners, operators, strategic counterparties, service providers and other stakeholders;
maintaining appropriate records of communications and relationships;
protecting the security, integrity and legitimate interests of TruePath, its systems and its information;
complying with applicable legal, regulatory, contractual and compliance obligations;
establishing, exercising or defending legal rights; and
other purposes disclosed at the time personal data is collected or otherwise authorized by the data subject.
TruePath will not process personal data for purposes that are incompatible with those disclosed or otherwise permitted by applicable law.
5. Authorization and Legal Grounds for Processing
Where required by applicable law, TruePath processes personal data on the basis of the data subject’s prior, express and informed authorization.
By voluntarily providing personal data through a contact form or other mechanism where an authorization notice is presented, you authorize TruePath to process such information for the purposes disclosed at the time of collection and in this Privacy Policy.
Personal data may also be processed without authorization where permitted or required by applicable law, including in circumstances involving legal obligations, orders from competent authorities or other legally recognized exceptions.
Where consent constitutes the applicable basis for processing, it may be revoked in accordance with applicable law, subject to any legal or contractual obligations requiring continued retention or processing.
Esta formulación es mejor que copiar “Legal basis: legitimate interest / consent” del GDPR. En Colombia, la regla general es autorización previa, expresa e informada, salvo las excepciones legales.
6. Cookies and Similar Technologies
This website may use cookies and similar technologies that are necessary for its operation, security, functionality, analytics or other permitted purposes.
Certain technical information may be collected automatically when users interact with the website.
Where required by applicable law, users will be provided with appropriate information and choices regarding non-essential cookies or similar technologies.
Users may also manage certain cookie preferences through their browser settings or any consent-management tools made available on the website.
7. How We Use and Protect Personal Data
Personal data may be processed through electronic, digital and, where applicable, physical means.
TruePath applies reasonable technical, administrative and organizational measures designed to protect personal data against unauthorized or unlawful access, alteration, disclosure, loss, misuse or destruction.
Access to personal data is limited, where appropriate, to persons and service providers who require such access for legitimate and authorized purposes.
No electronic transmission or information-storage system can be guaranteed to be completely secure. Accordingly, while TruePath takes reasonable measures to protect personal data, absolute security cannot be guaranteed.
8. Service Providers and Other Recipients
TruePath may disclose or provide access to personal data, where necessary and legally permitted, to:
authorized personnel and professional collaborators;
technology, hosting, cloud infrastructure, website administration, cybersecurity, communications and other service providers;
professional advisers, including legal, accounting, financial and compliance advisers;
contractual counterparties where disclosure is reasonably necessary and legally permitted;
governmental, regulatory, judicial or administrative authorities where required by applicable law or valid legal process; and
other recipients where authorized by the data subject or permitted by applicable law.
Service providers processing personal data on behalf of TruePath are expected to process such information only for authorized purposes and subject to appropriate confidentiality, security and data-protection obligations.
9. International Processing and Data Transfers
Due to the international nature of digital infrastructure and certain service providers used in connection with our activities, personal data may, where legally permitted, be processed, stored or transmitted outside Colombia.
Where international transfers or transmissions of personal data occur, TruePath will take measures required under applicable data protection law to ensure that such processing is conducted subject to appropriate legal and contractual safeguards.
TruePath does not represent that personal data will be processed exclusively within Colombia or within any particular jurisdiction.
Esta sección es especialmente importante. Colombia distingue jurídicamente entre transferencia y transmisión internacional y establece reglas específicas para ambas; por ejemplo, ciertas transmisiones a un encargado en el exterior pueden operar bajo un contrato de transmisión que cumpla los requisitos regulatorios.
10. Data Retention
TruePath retains personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected, maintain legitimate institutional and business records, comply with legal or regulatory obligations, resolve disputes and establish, exercise or defend legal rights.
Retention periods may vary depending on the nature of the information, the purpose of processing and applicable legal or contractual requirements.
When personal data is no longer reasonably required, it may be securely deleted, anonymized or otherwise processed in accordance with applicable law and TruePath’s information-management practices.
No pondría los “12 months” de la política actual salvo que sepamos que técnicamente los logs se eliminan exactamente a los 12 meses. Una Privacy Policy debe describir lo que realmente ocurre; no debemos inventar un plazo operativo que después TruePath no pueda demostrar.
11. Rights of Data Subjects
Subject to applicable law, data subjects may have the right to:
access and obtain information regarding their personal data;
know how their personal data has been processed;
request the correction or updating of inaccurate, incomplete or outdated personal data;
request proof of the authorization granted for processing, where applicable;
request information regarding the purposes for which their personal data has been used;
request deletion of personal data where legally applicable;
revoke authorization for processing where legally permitted; and
exercise any other rights provided under applicable data protection law.
Requests relating to personal data may be submitted to:
TruePath may request information reasonably necessary to verify the identity and authority of the person making the request before acting upon it.
Estos derechos corresponden mucho mejor al régimen colombiano. La SIC señala expresamente derechos de conocimiento, actualización, rectificación, supresión y, cuando proceda, revocatoria de la autorización.
12. Privacy Requests, Consultations and Claims
Data subjects may submit consultations, requests or claims concerning the processing of their personal data by contacting:
Requests should contain sufficient information to identify the data subject, describe the request and allow TruePath to evaluate and respond to it in accordance with applicable law.
TruePath will process consultations and claims within the time periods and according to the procedures established by applicable Colombian data protection law.
Where a request is incomplete, additional information may be requested where necessary to process it properly.
13. Sensitive Personal Data
TruePath does not generally seek to collect sensitive personal data through this website.
Users should avoid submitting sensitive personal data through general website communication channels unless such information is specifically requested and there is a legitimate and lawful reason for providing it.
Where TruePath processes sensitive personal data, such processing will be conducted in accordance with the specific requirements established by applicable law.
14. Data Relating to Minors
This website is intended for professional and institutional audiences and is not directed toward children or minors.
TruePath does not knowingly seek to collect personal data from minors through this website.
If TruePath becomes aware that personal data relating to a minor has been submitted without an appropriate legal basis or authorization where required, appropriate steps may be taken in accordance with applicable law.
15. Automated Decision-Making
TruePath does not use personal data collected through this website to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals, unless otherwise disclosed and permitted by applicable law.
16. Third-Party Websites
This website may contain links to websites or digital services operated by third parties.
TruePath is not responsible for the privacy practices, security or content of third-party websites. Users should review the applicable privacy policies of those third parties before providing personal data through their services.
17. Data Protection Authority
If you believe that the processing of your personal data does not comply with applicable data protection law, you may have the right to submit a complaint to the competent data protection authority, subject to the procedures and requirements established by law.
In Colombia, the competent data protection authority is the Superintendencia de Industria y Comercio (SIC).
Under Colombian law, the SIC is the relevant authority for the general personal-data protection regime established by Law 1581 of 2012.
18. Changes to This Privacy Policy
TruePath may update this Privacy Policy from time to time to reflect changes in its practices, technologies, legal requirements or website operations.
The version published on this website will constitute the current Privacy Policy. The “Last updated” date indicates when the policy was most recently revised.
19. Contact
For questions, requests or concerns regarding this Privacy Policy or the processing of personal data, please contact:
TruePath Investments S.A.S.
Bogotá D.C., Republic of Colombia
legal@tp-investments.com
