Terms of use and personal-data processing policy
Last updated: September 24, 2026
These terms of use and this personal-data processing policy (together, the “Policy”) govern (i) your use of the ApoloFX website and (ii) the collection, storage, use, circulation and deletion of the personal data you provide when you request to participate in the ApoloFX program as a cardholder (the “Program”). ApoloFX is a product operated by Piensa IT. Reading this Policy is essential: by ticking the authorization box and submitting the form you declare that you are of legal age, that you have read and understood this Policy in full, and that you grant your free, prior, express and informed consent for the processing of your data under the terms described here. If you do not agree, please do not submit the form.
1. Definitions
For clarity, the following terms are used throughout this Policy. Data Subject / You: the natural person whose personal data is collected and processed. Controller: ApoloFX, operated by Piensa IT, who decides on the database and the purpose and means of the processing. Processor: the natural or legal person that, alone or with others, processes personal data on the Controller’s behalf (for example, our hosting or email providers). Personal Data: any information linked to or that can be associated with one or more identified or identifiable natural persons (e.g. name, email, location). Sensitive Data: data affecting the Data Subject’s privacy or whose misuse may lead to discrimination (e.g. health, ethnicity, political or religious beliefs, biometrics) — the Program does NOT request this. Processing: any operation on personal data, such as collection, storage, use, circulation, transfer or deletion. Authorization: the Data Subject’s prior, express and informed consent to process their data. Database: the organized set of personal data subject to processing — here, the ApoloFX waitlist. Program / Waitlist: the ApoloFX card application and waiting-list process this form feeds.
2. Controller and contact
The controller of your personal data is ApoloFX, a product operated by Piensa IT. All communications, questions, and requests to exercise your data-protection rights (access, correction, deletion, withdrawal of consent, etc.) must be sent to [email protected], which is the single official channel for this purpose. We handle each request within the timeframes set by the applicable law (see section 11). We recommend keeping proof of your request (date and content) in case you need to follow up.
3. Legal framework and territorial scope
ApoloFX processes personal data in accordance with the data-protection law applicable to each Data Subject’s country of residence. This includes, without limitation: Colombia — Law 1581 of 2012 (General Data Protection Regime), Decree 1074 of 2015, and the guidance of the Superintendencia de Industria y Comercio (SIC); European Union / EEA — Regulation (EU) 2016/679 (GDPR); United Kingdom — the UK GDPR and the Data Protection Act 2018; México — the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its INAI guidelines; and the equivalent regimes of any other country from which a Data Subject accesses the Program. Where two or more of these rules apply and conflict, ApoloFX will apply, in good faith, the standard that is most protective of the Data Subject.
4. Personal data we collect and how
We collect only the minimum data needed to run the Program. Data you provide directly through the form: your full name, your email address, and your location (city and/or country). Data derived from your participation: if you arrive from an invitation link, the referral code that attributes you to the person who invited you, and — if you invite others — your own referral code and the count of your referrals. Data collected automatically for operating, securing and measuring the service: the language of your browser or of the page you visit, your approximate IP address and derived country (used to route you to the right language and to prevent abuse), the date and time of your registration, and basic analytics/usage data (see section 15). We do not collect sensitive data, government IDs, or financial/banking information at this waitlist stage; if in the future the Program requests additional data for a later phase (e.g. issuing the card), it will be requested separately and with its own authorization.
5. Purpose of the processing
Your data is processed for the following specific purposes: (a) to validate, register and manage your request to participate in the ApoloFX Program as a cardholder, including verifying that the data is coherent and not duplicated; (b) to contact you about the status of your request, your position or spot on the waitlist, and the launch or availability of the card; (c) to operate the referral program — generate your referral code, attribute the invitations you send, prevent fraud or self-referral, and apply any benefits; (d) to send you communications strictly related to the Program and, only if you separately consent, other news about ApoloFX; (e) to secure the service, prevent fraud, abuse and spam, and keep audit and traceability records; (f) to produce aggregate, de-identified statistics about interest in the Program; and (g) to comply with legal obligations and respond to requests from competent authorities. We will not use your data for purposes other than these without first obtaining your authorization.
6. Authorization (habeas data) and legal basis
The legal basis for the processing is your consent, granted when you tick the authorization box and submit the form — consent that, under Colombian law, is free, prior, express and informed, and of which we keep a record (date, purpose and version of this Policy). In the EU/EEA and the UK, the legal bases are your consent (Art. 6(1)(a) GDPR) and the taking of pre-contractual steps at your request (Art. 6(1)(b)); for security and fraud-prevention we also rely on our legitimate interest (Art. 6(1)(f)), balanced against your rights. Your authorization covers the purposes in section 5 and the involvement of the processors in section 8. You may withdraw your consent and/or request deletion of your data at any time through [email protected]; withdrawal does not affect the lawfulness of processing carried out before it. Providing the data is voluntary, but without the essential data (name and email) we cannot register your request.
7. No disclosure or sale to third parties
ApoloFX does not sell, rent, trade or disclose your personal data to third parties for their own commercial, advertising or profiling purposes, under any circumstances. Your data is accessed only by (i) authorized ApoloFX/Piensa IT personnel who need it to operate the Program, bound by confidentiality, and (ii) the processors listed in section 8, who act solely on our instructions and on our behalf. We will disclose data to a third party only when: a competent judicial or administrative authority requires it through a valid legal order; it is necessary to comply with a legal or regulatory obligation; or it is needed to protect the life, security or rights of the Data Subject, of ApoloFX or of third parties, or to establish, exercise or defend legal claims. In such cases we disclose only the minimum data strictly required.
8. Processors and sub-processors
To operate the Program we rely on technology providers that process data on our behalf and under our instructions, under confidentiality and security commitments: Supabase — database and storage of the waitlist; Netlify — hosting, serverless functions and delivery of the website; Piensa IT “Deliver” (internal email service) and/or the email provider we use — sending the Program’s notifications and the admin summary; Google Analytics — aggregate audience measurement (see section 15). These providers may operate infrastructure located outside your country (see section 9). We choose providers that offer adequate guarantees, and we do not authorize them to use your data for their own purposes. The current list of processors may change as the service evolves; the version in force is the one published in this Policy.
9. International transfers and transmissions
Because ApoloFX uses cloud infrastructure, your data may be stored or processed on servers located outside your country of residence (for example, in the United States or the European Union). When an international transfer or transmission takes place, ApoloFX adopts the safeguards required by the applicable law so that your data keeps a level of protection equivalent to the one it would have in your country — for example, contractual clauses with the recipient, the recipient being located in a country with an adequate level of protection, or your informed authorization. By accepting this Policy you are informed of, and authorize, such transfers and transmissions for the purposes described in section 5.
10. Your rights as Data Subject
You may exercise the following rights, free of charge and as many times as the law allows: know and access the personal data we hold about you and the use we give it; update and rectify partial, inaccurate, incomplete or out-of-date data; request deletion (right to be forgotten) of your data when its processing is not warranted or when you withdraw your consent; request proof of the authorization you granted, unless the law exempts us; be informed, upon request, of the use we have made of your data; object to or restrict the processing; withdraw your consent at any time; and, where the applicable law grants them (e.g. GDPR/UK), the rights to data portability and to not be subject to solely automated decisions — noting that the Program does not carry out automated decision-making with legal effects on you. Exercising a right will never, on its own, be a reason to exclude you from the Program, beyond the natural effect that deleting your data ends your participation.
11. How to exercise your rights and response times
To exercise any right, write to [email protected] from the email you registered (or providing enough information to identify you), stating clearly what you request. We may ask for reasonable additional information to verify your identity before acting, precisely to protect your data. Response times: under Colombian law, a *consulta* (request to know/access) is answered within ten (10) business days, extendable by up to five (5) more; a *reclamo* (request to correct, update, delete or revoke) is answered within fifteen (15) business days, extendable by up to eight (8) more, and we will tell you if an extension applies. Under the GDPR/UK GDPR, we respond within one (1) month, extendable by two further months for complex requests, and we will notify you. If you consider that your request was not properly handled, you may escalate it to the competent authority (section 17).
12. Information security
ApoloFX adopts reasonable technical, human and administrative measures to protect your data against loss, theft, unauthorized or fraudulent access, alteration, disclosure or destruction. These include, among others: encryption of data in transit (HTTPS/TLS), access controls and least-privilege permissions on the database, keeping secret keys server-side (never exposed in the public website), data minimization, and audit/traceability logs. No system is completely infallible; if a security incident occurs that seriously affects your data, we will act to contain and remedy it and, where the applicable law requires, we will notify the competent authority and/or the affected Data Subjects.
13. Data retention
We keep your personal data for as long as the Program and your request remain active, and only for the time needed to fulfil the purposes in section 5. Your data will be deleted or anonymized when: you request its deletion or withdraw your consent; it is no longer necessary for the purpose for which it was collected; or the Program ends without moving to a later phase. We may keep certain data for a longer period only when a legal or regulatory obligation requires it, or to establish, exercise or defend legal claims, and only for as long and to the extent strictly necessary. Aggregate, de-identified statistics that no longer allow identifying you may be kept without time limit.
14. Minors
The Program is aimed exclusively at adults (18 years or older). We do not knowingly collect or process personal data of minors. By submitting the form you declare that you are of legal age. If we learn that we have collected data from a minor without proper authorization from their legal representative, we will delete it as soon as possible. If you are the parent or guardian of a minor and believe they have provided us data, please contact [email protected].
15. Cookies, analytics and similar technologies
The website uses strictly necessary technologies to function and analytics technologies (Google Analytics) to understand, in aggregate, how the site is used and to improve it, collecting the minimum necessary (e.g. pages visited, approximate country, device/browser type). These tools may set cookies or similar identifiers in your browser. You can manage or disable cookies from your browser settings; disabling the non-essential ones does not prevent you from registering. We do not use these technologies to build advertising profiles or to sell your data. Where the applicable law requires prior consent for non-essential cookies, it will be requested through the corresponding mechanism.
16. Referral program
If you take part in the referral program, we process the referral code assigned to you and the count of people who register through your invitation, in order to attribute invitations and apply any benefits. The person who registers through your link accepts this same Policy and their data is treated as that of any other Data Subject; we do not give you access to their personal data beyond the aggregate count of your referrals. We apply anti-fraud controls (for example, preventing self-referral or manipulation of the counter). Participating in the referral program is optional.
17. Supervisory authorities
Without prejudice to contacting us first at [email protected], you have the right to lodge a complaint with the data-protection authority of your country, in particular: in Colombia, the *Superintendencia de Industria y Comercio (SIC)*; in the European Union/EEA, your national supervisory authority (and, at EU level, the European Data Protection Board); in the United Kingdom, the *Information Commissioner’s Office (ICO)*; and in México, the *INAI*. We appreciate the chance to resolve your concern directly before you escalate it, but exercising this right is always yours.
18. Use of the website (terms of use)
This website is informational and its purpose is to present ApoloFX and let you request participation in the Program. By using it you agree to: use it lawfully and in good faith; not attempt to breach its security, interfere with its operation, send spam or automated/fraudulent registrations, or impersonate other people. All content, brands, logos, texts and designs of ApoloFX and Piensa IT are protected by intellectual-property rights and may not be used without authorization. Registering on the waitlist does not create any contractual, financial or credit relationship, nor does it guarantee a spot, the approval or the issuance of a card; the card and any financial service will be subject to their own separate terms, requirements and authorizations at the appropriate time. Information on the site (rates, benefits, availability) is indicative and may change without notice.
19. Changes to this Policy
ApoloFX may update this Policy to reflect legal, technical or operational changes. The version in force will always be the one published on this page, identified by its “last updated” date. When a change is substantial and affects the purposes or your rights, we will make reasonable efforts to inform you (for example, by email or a notice on the site) and, where the law requires it, we will request a new authorization. Continuing to use the site or the Program after an update implies that you are aware of the version in force.
20. Governing law, jurisdiction and acceptance
This Policy is governed by the law applicable to your country of residence and, where relevant, by the laws of the Republic of Colombia, where the Controller operates; any dispute will be submitted to the courts with jurisdiction under the applicable law. If any provision of this Policy is held invalid, the remaining provisions stay in force. By ticking the authorization box and submitting the form, you acknowledge that you have read, understood and accepted this Policy in full. For anything related to your data or these terms, contact [email protected].