1. Identification of the Data Controller

The Data Controller (Responsable del Tratamiento) of the personal data collected through the website www.globaladinsights.com and its associated contact channels is:

In this policy, the Data Controller is also referred to as «GlobalADInsights».

2. Legal framework

This policy is issued pursuant to Article 15 of the Colombian Political Constitution, Statutory Law 1581 of 2012, Single Regulatory Decree 1074 of 2015 —which compiled Decree 1377 of 2013— and any rules that amend, supplement or replace them, as well as the instructions issued by the Superintendence of Industry and Commerce (SIC), Colombia's data protection authority.

3. Scope

This policy applies to all personal data of natural persons that GlobalADInsights collects, stores, uses or otherwise processes through the website forms and the communications arising from them, as well as to browsing data collected through analytics cookies when the Data Subject authorizes it. It is binding on the Data Controller and on the Data Processors that process data on its behalf.

GlobalADInsights' services are aimed at companies and organizations. The data processed belong to the natural persons who act on their behalf or represent them, or who are interested in its services.

4. Definitions

For the purposes of this policy, the definitions of Law 1581 of 2012 and Decree 1074 of 2015 apply:

• Authorization. Prior, express and informed consent of the Data Subject for the processing of his or her personal data.
• Privacy notice. Verbal or written communication addressed to the Data Subject informing him or her of the existence of this policy, how to access it and the purposes of the processing.
• Database. Organized set of personal data subject to processing.
• Personal data. Any information linked to, or that may be associated with, one or more identified or identifiable natural persons.
• Sensitive data. Data that affect the Data Subject's privacy or whose misuse may lead to discrimination, under Article 5 of Law 1581 of 2012.
• Data Processor (Encargado del Tratamiento). Natural or legal person that processes personal data on behalf of the Data Controller.
• Data Controller (Responsable del Tratamiento). Natural or legal person that decides on the database and/or the processing of the data.
• Data Subject (Titular). Natural person whose personal data are processed.
• Processing. Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
• Transfer. Sending of personal data by the Data Controller to a recipient that is itself a Data Controller, inside or outside Colombia.
• Transmission. Communication of personal data inside or outside Colombia for processing by a Data Processor on behalf of the Data Controller.

5. Principles

GlobalADInsights applies the principles of Article 4 of Law 1581 of 2012 to the processing of personal data:

• Legality: Processing is subject to the law and its implementing rules.
• Purpose. Processing serves legitimate purposes communicated to the Data Subject.
• Freedom. Processing only takes place with the prior, express and informed authorization of the Data Subject.
• Accuracy or quality. Information processed must be truthful, complete, accurate, up to date, verifiable and understandable.
• Transparency. The Data Subject may obtain, at any time and without restriction, information about the existence of data concerning him or her.
• Restricted access and circulation. Data are accessible only to the Data Subject, persons authorized by the Data Subject and persons provided for by law; they are not published on the internet or in mass media.
• Security. Data are protected with the technical, human and administrative measures needed to prevent their tampering, loss, consultation, use or unauthorized or fraudulent access.
• Confidentiality. Everyone involved in the processing must keep the information confidential, even after their relationship with the Data Controller ends.

6. Personal data processed

GlobalADInsights processes the data that the Data Subject voluntarily provides through the website forms, the technical data generated when the Data Subject receives its emails and when he or she grants authorization and, when the Data Subject authorizes it, the browsing data described in section 19:

• Identification and contact data. First and last name, email address, country and, when the Data Subject chooses to provide it, phone or WhatsApp number.
• Professional data. Company or organization, job title, number of employees, the company's main activity and whether it holds ISO 9001 certification.
• Answers to the AS9100 certification readiness self-assessment. The Data Subject's answers to the questions about his or her company's quality management system and the score calculated from them.
• Content of communications. The information the Data Subject includes in messages sent through the contact form.
• Email interaction data. When the Data Subject receives emails from GlobalADInsights, the sending platform records technical data such as delivery, opening of messages, clicks on their links and the IP address from which they are opened. These data are used to verify delivery and the relevance of the communications.
• Browsing data. Only if the Data Subject accepts analytics cookies: pages visited, time on site, referring site, type of device and browser, language, approximate location (country and city) and a random identifier assigned by the cookie. They are used in aggregate form to understand how the website is used and are not combined with form data.
• Evidence of authorization. Date, time, IP address, text accepted and version of this policy in force when the Data Subject grants authorization. These data are kept for the sole purpose of proving the authorization, under Article 9 of Law 1581 of 2012.

Fields marked as mandatory in each form are those needed to handle the Data Subject's request. All other fields are optional.

7. Sensitive data and data of children and adolescents

GlobalADInsights does not request or process sensitive data as defined in Article 5 of Law 1581 of 2012, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership of trade unions or social or human rights organizations, or data concerning health, sex life and biometric data. Data Subjects are asked not to include this type of information in the free-text fields of the forms. If received, it will be deleted.

GlobalADInsights' services are not aimed at minors, and no data of children or adolescents are collected. If data of a minor are found to have been received, they will be deleted.

8. Processing and purposes

Personal data will be collected, stored, consulted, used, updated, transmitted to the Data Processors listed in section 10 and deleted, exclusively for the following purposes:

1. Delivering to the Data Subject the report, self-assessment result or document he or she requested.
2. Handling and answering his or her requests for contact, information, quotes or advisory services.
3. Following up on the request made and offering advisory services related to the subject of the enquiry.
4. Sending publications, analysis and reports on the aerospace and defense sector, only when the Data Subject has specifically and separately authorized it.
5. Preparing aggregated and anonymized statistics about the sector that do not identify individuals or organizations.
6. Complying with legal obligations and responding to requests from competent authorities.
7. Measuring website use in aggregate form, through Google Analytics, to improve its content, only when the Data Subject has accepted analytics cookies.
8. Verifying the delivery of the emails sent to the Data Subject and measuring their relevance, based on the interaction data described in section 6.
9. Keeping proof of the authorization granted by the Data Subject, under Article 9 of Law 1581 of 2012.

GlobalADInsights does not sell, rent or assign personal data to third parties for commercial or advertising purposes, nor does it subject them to decisions based solely on automated processing that produce legal effects for the Data Subject. The self-assessment score is for information only.

Any purpose other than those listed here will require a new authorization from the Data Subject.

Commercial and follow-up communications under purposes c) and d) will be made only through the channels the Data Subject has authorized, Monday to Friday between 7:00 a.m. and 7:00 p.m. and Saturdays between 8:00 a.m. and 3:00 p.m. (Colombia time), never on Sundays or public holidays, and with the frequency permitted by Law 2300 of 2023. The Data Subject may at any time indicate the channels through which he or she prefers to be contacted, or ask not to be contacted.

9. Authorization

The Data Subject's authorization is obtained in a prior, express and informed manner, through checkboxes that the Data Subject actively ticks in the form before submitting it. The checkboxes are not ticked by default. A privacy notice with a link to this policy is placed next to them.

Authorization to receive sector publications (purpose d) is requested in a separate, optional checkbox. Declining it does not prevent the Data Subject from receiving the requested report or being assisted.

Authorization for analytics cookies is obtained through the website's cookie notice, which offers «Accept» and «Reject» options with equal prominence. Until the Data Subject clicks «Accept», these cookies are not set. By accepting them, the Data Subject also authorizes the transmission of browsing data to Google, under the terms of section 10. The Data Subject may change this decision at any time through the «Cookies» link at the bottom of every page.

GlobalADInsights keeps proof of each authorization —date, time, IP address, text accepted and version of this policy— and will make it available to the Data Subject upon request.

Under Article 10 of Law 1581 of 2012, no authorization is required for information requested by a public or administrative entity in the exercise of its legal duties or by court order, for data of a public nature, in cases of medical or health emergency, for processing authorized by law for historical, statistical or scientific purposes, or for data related to the civil registry of persons.

10. Data Processors and international transmission of data

To provide its services, GlobalADInsights relies on the following providers, which act as Data Processors and process the data on behalf of and under the instructions of the Data Controller:

Because these providers are located outside Colombia, sending data to them constitutes an international transmission of personal data. It is carried out under Articles 2.2.2.25.5.1 and 2.2.2.25.5.2 of Decree 1074 of 2015, through the data processing agreements that form part of each provider's terms of service. These agreements are governed by the European Union General Data Protection Regulation and contain obligations equivalent to those that Colombian law imposes on Data Processors. Under them, each Data Processor undertakes to: (i) process the data to provide the service, following the Data Controller's instructions; (ii) adopt appropriate security measures; (iii) maintain confidentiality; (iv) not disclose the data to third parties, except to its sub-processors, subject to equivalent obligations, or when required by law; (v) report security incidents to the Data Controller; and (vi) delete the data when the relationship ends, under the conditions set out in each agreement.

In addition, the United States and the Member States of the European Union, where these providers operate, are included in the list of countries with an adequate level of personal data protection established by the Superintendence of Industry and Commerce in External Circular 005 of 2017.

Some sub-processors of these providers operate in other countries, including the United States. In those cases, the providers apply the safeguards set out in their contracts, such as the European Union standard contractual clauses.

Under its terms of service, Brevo may make limited use of technical data from email sends, such as IP address and open and click logs, to ensure the security and availability of its service and to produce usage statistics, in accordance with its own privacy policy, available at www.brevo.com/legal/privacypolicy.

For Google Analytics, processing is governed by the data processing terms that Google offers to users of this tool. Google Analytics 4 does not log or store visitors' IP addresses. GlobalADInsights does not enable advertising or cross-device tracking features in this tool. Google processes these data in accordance with its own privacy policy, available at policies.google.com/privacy.

GlobalADInsights does not transfer personal data to third parties acting as Data Controllers, except at the request of a competent authority, in the cases permitted by Article 26 of Law 1581 of 2012, or in the situation described in section 20 of this policy.

If GlobalADInsights replaces or adds a Data Processor, it will update this section before transmitting any data to it.

11. Rights of Data Subjects

Under Article 8 of Law 1581 of 2012, the Data Subject has the right to:

1. Know, update and rectify his or her personal data, in particular data that are partial, inaccurate, incomplete, fragmented, misleading, or whose processing is prohibited or has not been authorized.
2. Request proof of the authorization granted, except where the law does not require it.
3. Be informed, upon request, of the use made of his or her personal data.
4. File complaints with the Superintendence of Industry and Commerce for violations of the law, once the enquiry or claim procedure before GlobalADInsights has been exhausted.
5. Revoke the authorization and/or request the deletion of his or her data, provided there is no legal or contractual duty requiring the data to remain in the database.
6. Access his or her personal data free of charge.

GlobalADInsights does not charge any fee for handling enquiries or claims.

12. Persons entitled to exercise these rights

The rights of Data Subjects may be exercised by:

• The Data Subject, who must prove his or her identity.
• His or her successors in title, who must prove that status.
• His or her representative or attorney, upon proof of the representation or power of attorney.
• Another person, by stipulation in favor of or on behalf of another.

GlobalADInsights will only request the information strictly necessary to verify the identity or standing of the person making the request.

13. Duties of the Data Controller

In compliance with Article 17 of Law 1581 of 2012, GlobalADInsights undertakes, among other duties, to:

• Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.
• Request and keep a copy of the authorization granted by the Data Subject.
• Inform the Data Subject of the purpose of the collection and of his or her rights.
• Keep the information under the security conditions needed to prevent its tampering, loss, consultation, use or unauthorized or fraudulent access.
• Ensure that the information provided to Data Processors is truthful, complete, accurate, up to date, verifiable and understandable, and require them to respect security and privacy conditions.
• Update and rectify information when it is incorrect, and handle enquiries and claims as provided by law.
• Maintain an internal manual of policies and procedures to ensure proper compliance with the law, in particular for handling enquiries and claims.
• Inform the Superintendence of Industry and Commerce of any breach of security codes that creates risks in the management of Data Subjects' information.
• Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

14. Handling of requests, enquiries and claims

Requests, enquiries and claims related to the processing of personal data are handled directly by the Data Controller, who also acts as personal data protection officer, through the following channels:

• Email: admin@globaladinsights.com
• Postal mail addressed to: Carrera 24 No. 40-25, Calarcá, Quindío, Colombia.

The request must include, at a minimum: the full name of the Data Subject and, where applicable, of the person acting on his or her behalf; a clear description of the enquiry or claim; the physical or email address to receive the response; and any supporting documents.

15. Procedure for enquiries

The Data Subject or the persons entitled may consult the personal information held in GlobalADInsights' databases. The Data Controller will provide all the information contained in the individual record or linked to the Data Subject's identification.

Enquiries will be answered within a maximum of ten (10) business days from receipt. When this is not possible, the requester will be informed, before the deadline, of the reasons for the delay and the date on which the enquiry will be answered, which in no case may exceed five (5) business days after the first deadline.

16. Procedure for claims

A Data Subject or entitled person who considers that information in a database should be corrected, updated or deleted, or who notices an alleged breach of any of the duties set out in the law, may file a claim, which will be handled as follows:

• If the claim is incomplete, the claimant will be asked within five (5) days of receipt to remedy the deficiencies. If two (2) months pass from the date of that request without the claimant providing the required information, the claim will be deemed withdrawn.
• If the person receiving the claim is not competent to resolve it, it will be forwarded to the appropriate party within a maximum of two (2) business days, and the claimant will be informed.
• Once the complete claim is received, a note reading «claim in process» and its reason will be added to the database within no more than two (2) business days. The note will remain until the claim is resolved.
• The maximum period to resolve the claim is fifteen (15) business days from the day after its receipt. When this is not possible, the claimant will be informed of the reasons for the delay and the date on which the claim will be resolved, which in no case may exceed eight (8) business days after the first deadline.

Revocation of authorization and deletion of data

The Data Subject may at any time revoke the authorization granted and/or request the deletion of his or her data by filing a claim under this section. Revocation may be total, covering all purposes, or partial, covering only some of them, such as receiving publications. Revocation and deletion will not apply when the Data Subject has a legal or contractual duty to remain in the database.

In addition, every publication email includes a link to unsubscribe immediately, without the need to file a claim.

Once a deletion request has been fulfilled, only the record of the request and its handling will be kept, to prove compliance with the law.

17. Prerequisite for filing complaints

Under Article 16 of Law 1581 of 2012, the Data Subject or successor in title may only file a complaint with the Superintendence of Industry and Commerce after exhausting the enquiry or claim procedure before GlobalADInsights.

18. Information security

GlobalADInsights adopts reasonable technical, human and administrative measures to protect personal data against tampering, loss, consultation, use or unauthorized or fraudulent access, including: encrypted transmission through a TLS certificate; access to information restricted by personal credentials, with temporary lockout after failed login attempts and automatic closing of inactive sessions; access limited to those who need it to perform their duties; and the requirement that Data Processors maintain equivalent security conditions.

If an incident compromises the security of personal data, GlobalADInsights will report it to the Superintendence of Industry and Commerce in accordance with applicable regulations and will take the necessary measures to mitigate its effects.

19. Cookies and web analytics

The website www.globaladinsights.com uses cookies, which are small files that the browser stores on the Data Subject's device. Two types are used:

• First-party technical cookie. The «gadi_consent» cookie stores the Data Subject's choice on the cookie notice («accepted» or «rejected») for one hundred eighty (180) days, so that he or she is not asked again on every visit. It contains no personal data and is necessary to respect that choice.
• Google Analytics cookies. The «_ga» cookie and the cookie «_ga_» followed by an identifier distinguish visits pseudonymously and measure website use. They are only set if the Data Subject clicks «Accept» on the cookie notice and last up to two (2) years, unless the Data Subject deletes them earlier.

With the information from these cookies, GlobalADInsights only consults aggregated statistical reports, such as the number of visits, the most read pages, countries of origin or device type. It does not identify visitors, does not combine this information with form data and does not use it for advertising purposes. Google Analytics keeps visit-level detail for two (2) months and the data associated with the cookie identifier for fourteen (14) months from the Data Subject's last visit. After these periods, only the aggregated statistical reports remain.

The Data Subject may withdraw this authorization at any time through the «Cookies» link at the bottom of every page: clicking «Reject» deletes the analytics cookies and stops them from being set. Cookies can also be blocked or deleted in the browser settings. Rejecting analytics cookies does not prevent use of the website.

20. Data retention and term of the databases

Personal data will be kept only for the reasonable and necessary time to fulfill the purposes for which they were collected, as follows:

• Persons who requested a report, completed the self-assessment or made an enquiry and did not hire services: up to twenty-four (24) months from their last interaction with GlobalADInsights.
• Clients: for the duration of the contractual relationship and any additional period required by applicable law.
• Publication subscribers: for as long as the subscription remains active.
• Evidence of authorization: for as long as the data are processed and for the period needed to respond to requests from authorities or related claims.

Once these periods have expired, and if there is no legal duty to retain them, the data will be deleted or anonymized so that the Data Subject cannot be identified.

GlobalADInsights' databases will remain in force for as long as the Data Controller carries out the activities that justify the processing described in this policy, without prejudice to the retention periods set out here and to the Data Subject's right to request deletion of his or her data at any time.

If the Data Controller incorporates a company to continue the activity of GlobalADInsights, personal data may be transferred to that company, which will become the Data Controller, for the same purposes and under a processing policy offering at least the same guarantees. Data Subjects will be informed in advance and will retain all their rights, including the right to revoke their authorization.

21. Changes to this policy

Any substantial change to this policy, in particular changes regarding the identity of the Data Controller or the purposes of the processing, will be communicated to Data Subjects in a timely manner through the website and, where appropriate, by email, before it takes effect. When the change concerns the purposes of the processing, a new authorization will be requested.

Each version of this policy is identified by a number and an effective date, and GlobalADInsights keeps a record of the version accepted by each Data Subject.

22. Effective date

This policy takes effect on October 23, 2026 and will remain in force until it is amended or replaced.

This policy is published in Spanish. Any translation into another language is for information only and, in case of any difference, the Spanish text prevails.

Version history: version 1.0 (October 1, 2026), initial version, not published; version 1.1 (October 23, 2026), adds processing through cookies and web analytics, and is the first version published on the website.

1. Who operates this website

The website www.globaladinsights.com is operated by Alvaro Gelverth Molano Valbuena, a natural person doing business under the trade name «GlobalADInsights», domiciled in Armenia, Quindío, Colombia. You can write to us at contact@globaladinsights.com.

2. Acceptance of these terms

By browsing the website or using its content and forms, you accept these Terms of Service. If you do not agree with them, please do not use the website.

3. What the website offers

The website publishes analysis, reports and informational tools on the aviation, space and defense sectors in Latin America, such as the AS9100 readiness self-assessment. This content is free and for information purposes.

Advisory, training and market entry services are contracted through a separate proposal or agreement, which sets out their scope, price, confidentiality and conditions. In case of any difference, that agreement prevails over these terms.

4. Intellectual property

The texts, analysis, reports, charts, databases and other content of the website belong to GlobalADInsights or are used with permission, and are protected by Colombian Law 23 of 1982, Andean Decision 351 of 1993 and other copyright rules.

You may consult the content, download the free reports for the internal use of yourself or your organization, and quote brief excerpts citing the source and the link. You may not reproduce, distribute, sell, modify or publish the content, in whole or in part, without prior written authorization.

5. Acceptable use

When using the website, you agree not to:

• Use it for unlawful purposes or contrary to these terms.
• Attempt to access restricted areas, such as the administration system, or affect its operation or security.
• Extract content massively or by automated means.
• Provide false information, or third-party data without their authorization, in the forms.

6. AS9100 self-assessment

The self-assessment provides an indicative reading based solely on the answers of the person who completes it. It is not an audit, does not verify the company's operations and is not equivalent to a certification. GlobalADInsights is not a certification body. The AS9100, AS9110 and AS9120 standards belong to their respective issuers.

7. Personal data and cookies

Any personal data you provide is processed in accordance with our Personal Data Processing Policy. The use of cookies is explained in section 19 of that policy.

8. Limitation of liability

The website's content expresses GlobalADInsights' professional judgment based on the information available at the time of publication. It does not constitute legal, financial, investment or regulatory advice. To the extent permitted by law, GlobalADInsights is not liable for decisions made solely on the basis of this content, nor for temporary interruptions or failures of the website.

Nothing in these terms limits liability that cannot be limited under Colombian law, such as liability for willful misconduct or gross negligence, or the rights that Law 1480 of 2011 grants to consumers.

9. Confidentiality of advisory engagements

Information shared by clients in the course of an advisory engagement is treated with strict confidentiality, under the agreement signed in each case, and is not mentioned in publications without their express authorization.

10. Links to other websites

The website may include links to third-party websites for reference. GlobalADInsights does not control those websites and is not responsible for their content or privacy practices.

11. Changes to these terms

We may update these terms. The version in force is the one published on this page, with its update date.

12. Governing law and jurisdiction

These terms are governed by the laws of the Republic of Colombia. Any disputes arising from the use of the website will be submitted to the competent courts of Colombia, unless a service agreement provides otherwise and without prejudice to consumers' non-waivable rights.

13. Language

These terms are published in Spanish. Any translation into another language is for information only and, in case of any difference, the Spanish text prevails.

Information purposes

The information published on this website by GlobalADInsights is for information and professional analysis purposes. It is provided in good faith; however, we do not guarantee that it is accurate, complete, current or suitable for any particular purpose.

Not professional advice

The analysis, reports and assessments published reflect our professional judgment based on the information available at the time of publication. They do not constitute legal, financial, investment or regulatory advice. Before making decisions based on them, we recommend consulting the appropriate professionals.

Forward-looking statements

Some publications include projections about markets, public procurement or sector policies. They reflect our assessment on the date they were written and may change as market conditions evolve. We undertake no obligation to update them after publication.

Trademarks and third-party references

The names of companies, organizations, programs, products and standards mentioned, such as AS9100, belong to their respective owners. They are mentioned for information purposes and do not imply affiliation, sponsorship or endorsement.

Independence

GlobalADInsights is an independent firm. Unless expressly stated, its publications do not represent the position of governments, manufacturers or other organizations.

External links

This website may contain links to third-party websites for reference. We do not control their content and are not responsible for it, nor for any damage that may arise from their use.

Liability

This notice applies to the extent permitted by law and is complemented by our Terms of Service. Nothing in it limits liability that cannot be limited under Colombian law.

Governing law

This notice is governed by the laws of the Republic of Colombia. If any of its provisions is found to be invalid, the remaining provisions will remain in force.