Privacy and data protection policy

1. Data controller

Fundación Mobula, a non-profit organisation established in Colombia and based in Santa Marta, Magdalena, is responsible for processing the personal data collected through this site.

Tax ID (NIT) 902108369-1 · Address: Carrera 30 # 47-29, Santa Marta, Magdalena, Colombia · Phone: +57 350 598 5658 · Email: info@fundacionmobula.org.

The notification channel for everything relating to this policy is info@fundacionmobula.org. Writing there is enough: no other procedure is needed and there is no need to appear at an office.

2. What data we collect

We only collect what each form needs to work. We don't use advertising trackers or sell data to third parties.

• ◆Contact form and quote requests: name, email address, subject and message. For a quote, also the name of the organisation, an optional phone number and the project details: service, type of entity, country, ecosystem and timeframe.
• ◆Sighting reports: name, email address, the photograph you send and the location of the sighting. If the sighting is approved, your name is published in the Observatory crediting the record; the email is never published. If you prefer it not to appear, write to us and we will remove it.
• ◆Contributions (donations, memberships, symbolic adoptions and purchases): name, email address, optional phone number and identity document number —Colombian ID card or tax number (NIT)—, which is needed to issue the contribution receipt. Your card or account details are received directly by Wompi, the payment gateway: the foundation never sees or stores them. Wompi tells us the result of the payment and, for PSE payments, the document registered by the bank.
• ◆Newsletter: your email address and, if you wish, your name, together with the date on which you gave your authorisation.
• ◆CV bank: name, email address, optional phone number, area of interest, a message and your CV file, which is stored in a private repository.
• ◆WhatsApp channel (the foundation's assistant): your phone number, your WhatsApp profile name and the messages, photos and locations you send us. In a sighting report, also the name you want to be credited with and your email address; in an emergency, the animal, its condition, the location, the photo and your comment.
• ◆Technical data: to limit abuse of the forms we store an irreversible hash of the IP address, never the address itself.
• ◆Browsing, only if you accept measurement: the pages you visit, your country and your type of device and browser, through Google Analytics. Without your acceptance no identifier is stored. Details in the cookie policy.

3. What we use it for

• ◆To reply to your messages and requests.
• ◆To verify reported sightings before publishing them in the Observatory.
• ◆Handle the marine wildlife emergencies you report to us on WhatsApp, coordinate them with the competent authorities and answer the questions you send us through that channel.
• ◆Recording contributions, confirming their payment with the gateway and issuing the corresponding receipts.
• ◆To send you the outcome of the review of whatever you submitted.
• ◆Sending you the newsletter, if you subscribed. Every issue includes a way to unsubscribe.
• ◆Considering your CV when a vacancy opens that matches your profile.
• ◆Bringing together in a single record what the same person sends us through different forms —identifying them by their identity document or, failing that, by their email— so we can help them without asking for the same thing twice, reply to them and follow up on their contributions and requests. Only foundation staff can see that record, and it is not used for any other purpose.
• ◆To meet the foundation's accounting and legal obligations.

4. Sighting photographs

The photograph you send with a report is published in the Observatory if a biologist approves the record, credited with the name you provided.

Before upload, your browser strips all EXIF metadata from the image, including any GPS coordinates embedded by the camera. Coordinates are stored separately, and if the species is threatened they are blurred to a 10 km cell before being shown to the public.

5. Payments

Payments are processed through Wompi. The foundation does not receive or store card numbers or banking credentials: only the result of the payment, its reference, the method used and the amount.

Contribution records —and the receipts that were attached when payments were made by bank transfer— are kept in a private repository, accessible only to foundation staff, for as long as Colombian accounting regulations require.

6. Who it is shared with

We don't sell or transfer personal data. We share it only with the providers that make the site work, and only to the extent necessary:

• ◆Supabase, as our database and storage provider.
• ◆Amazon Web Services, which hosts the site and sends the foundation's emails.
• ◆Wompi, the gateway that processes payments.
• ◆Cloudflare, which checks on the forms that the sender is a person and not an automated program.
• ◆Google, through Google Analytics, which measures visits to the public site if you accept measurement. We do not use it for advertising.
• ◆Meta Platforms, through WhatsApp Business, which carries the messages between your phone and the foundation. It processes the data outside Colombia.
• ◆Competent authorities, where there is a legal obligation to hand them over.
• ◆In a marine wildlife emergency, the competent environmental or maritime authority —for example CORPAMAG, Colombia's National Natural Parks or DIMAR—, with the details of the case (animal, condition, location and photo) and, if needed to coordinate the response, your phone number.

The biodiversity records published in the Observatory are open, but never include your email address or phone number: only the name under which you asked to be credited.

Where your data is stored

The providers in the previous section process data only on the foundation's behalf and for what it asks of them: they cannot use it for their own purposes. Some of them store or process it on servers outside Colombia, mainly in the United States; the foundation's emails, for example, are sent from Amazon Web Services in that country.

By submitting any of the site's forms, or by writing to us on WhatsApp, you authorise that transmission, which is carried out with providers that apply recognised security standards and under Colombian Law 1581 of 2012 and its implementing decrees.

Children and adolescents

The site is not aimed at people under 18 and does not knowingly ask them for data. If you are a minor and want to report a sighting, subscribe to the newsletter or write to us, do it together with your parent or guardian: they are the one who must give the authorisation.

If we learn that we received a minor's data without that authorisation, we delete it. If you represent a minor and believe they sent us their data, write to us and we will erase it. The best interests of children and adolescents always come first, as required by article 7 of Law 1581 of 2012.

7. Your rights

Under Colombian Law 1581 of 2012, at any time you may:

• ◆To know, update and correct your personal data.
• ◆Request proof of the consent you gave.
• ◆Be informed about the use that has been made of them.
• ◆File complaints with the Superintendency of Industry and Commerce.
• ◆Withdraw consent and request deletion of your data, except where there is a legal duty to keep it.

To exercise any of these rights, write to info@fundacionmobula.org stating your request. We respond within the deadlines set by Colombian Law 1581 of 2012: ten working days for enquiries, extendable by five more (art. 14), and fifteen working days for complaints, extendable by eight more (art. 15). If you are not satisfied once that process ends, you may turn to the Superintendencia de Industria y Comercio, Colombia's data protection authority.

8. How long we keep it

We keep it for as long as necessary for the purpose that motivated its collection, or for as long as a legal obligation requires. An approved biodiversity record remains in the Observatory indefinitely, because its scientific value lies in the historical series; the reporter's name stays with it as credit.

Specifically: CVs are kept for two years from when you send them, unless you ask us to delete them sooner; your newsletter subscription, until you unsubscribe, after which we keep only the record of the unsubscription so that we do not write to you again; and contribution records, for as long as accounting regulations require.

On WhatsApp: conversation messages are deleted after 3 days; sighting reports are kept like those sent through the website; and emergency cases, for as long as they serve their follow-up and as the foundation's record. You can ask us at any time to delete your data from a case.

9. Security

We apply role-based access control over the database, so personal data is only readable by those with moderation permission. Communications travel encrypted and payment receipts are kept in private storage.

No system is infallible. Should an incident affecting your data occur, we will inform you and report it to the authority as required by law.

10. Changes to this policy

If we modify this policy we will publish the new version on this same page with its update date. Substantial changes will be communicated through the contact channels you have provided.