Data controller
This policy explains how Cocoito Zomac S.A.S. (hereinafter "Heavy Upgrade") collects, uses and protects personal data, in compliance with Ley 1581 de 2012 and Decreto 1377 de 2013 (compiled in Decreto 1074 de 2015).
- Responsible party
- Cocoito Zomac S.A.S., which operates the Heavy Upgrade brand
- Tax ID (NIT)
- 901.388.681-1
- Address
- Carepa, Antioquia, Colombia
- clientes@heavyupgrade.com (customer service and personal data) · gerencia@heavyupgrade.com (management)
- 320 539 3668
- Website
- www.heavyupgrade.com
What data we process
- Contact data: name, company, email, mobile number and whatever you tell us about your project through forms, WhatsApp or social media.
- Business data: proposals, contracts, invoices and payments.
- Images and voice: photos and videos of people who appear in the productions we create.
- Browsing data: whatever your browser stores based on your cookie choices.
What we use it for
- To reply to your messages, prepare proposals and deliver the services you hire us for.
- To invoice, collect payments and meet our legal, accounting and tax obligations.
- To coordinate shoots, deliveries, revisions and support.
- To send you information about our services, only if you authorize it; you can ask us to stop at any time.
- To showcase work in our portfolio and on social media, only with the authorization of the people who appear in it or their representative.
- To handle requests, complaints and claims.
Images, sensitive data and minors
A photo or video in which a person can be recognized is personal data, and facial features are considered sensitive data. That is why we only use a person's image for commercial or promotional purposes with their prior, express and informed authorization, and we keep proof of it. You are not required to authorize the processing of sensitive data.
Data belonging to children and adolescents is processed only in their best interest and with the authorization of their parent or legal representative. Use in our portfolio or on social media always requires a separate, voluntary authorization.
When we work with our clients' data
In some projects we handle data that is our clients' responsibility, such as people who book appointments on a website we built or staff who appear in a corporate video. In those cases we act as data processors: we use that data only for the project and according to the client's instructions, and the client is responsible for obtaining the authorizations.
Client portal, signatures and image releases
Our clients have a private portal they access with a personal link and a password. There we record the progress of their projects, their documents, approvals and electronic signatures. For security and as evidence of those actions we keep the date and time, IP address and browser of each login, approval and signature, together with the exact text that was accepted.
When a person signs an image use release in the portal during a shoot, we keep their name, ID number, signature and the uses they authorized; if they are a minor, also the details of their mother, father or legal guardian. Use in the Heavy Upgrade portfolio is always a separate, voluntary checkbox. We keep these records while the material is in use and for as long as the law requires, and they can be consulted or revoked for future uses by writing to clientes@heavyupgrade.com.
Who we share it with
We do not sell your data. We share it only with providers we need in order to work, such as website hosting, WhatsApp, email, invoicing software and payment gateways, and with authorities when the law requires it. Some of these providers store information outside Colombia, with appropriate security measures.
Your rights
As the data subject, you have the right to:
- Access, update and correct your data.
- Request proof of the authorization you gave us.
- Know how we have used your data.
- Revoke your authorization or ask us to delete your data, when there is no legal or contractual duty to keep it.
- Access your data free of charge.
- File complaints with the Superintendencia de Industria y Comercio after first submitting your inquiry or claim to us.
How to exercise your rights
Contact us through our Requests & complaints page by choosing "Request", on WhatsApp at 320 539 3668 or by email at clientes@heavyupgrade.com. Include your name, how we can reach you and what you need.
- Inquiries: we respond within 10 business days at most, extendable by 5 more business days, in which case we will tell you why.
- Claims (correction, update, deletion or revocation): we respond within 15 business days at most, extendable by 8 more business days, in which case we will tell you why. If your claim is incomplete, we will ask you for what is missing within the following 5 days.
The area responsible for handling these requests is Heavy Upgrade's general management.
Security and retention
We protect information with passwords, restricted access and backups. We keep data for as long as the business relationship lasts and for the time required by accounting and tax regulations. Project material is kept for the period agreed in each proposal.
Effective date
This policy is effective as of October 22, 2026. Databases will be kept for as long as they are needed for the purposes described. If we make significant changes, we will publish them on this page.