Privacy Policy

This policy explains how Ges2l processes personal data and institutional data when someone visits the landing page, uses a platform account, or is linked by an institution.

The content is limited to capabilities implemented in the repository: SSO authentication, institutional management, academic modules, R2 files, landing cookies, consent-based analytics, and documented infrastructure services.

Policy scope

This policy applies to the Ges2l landing page and to the Panel, Academy, Accounts, and MyAccount applications when they are used with an institutional account.

Academic and administrative data created by an institution in Ges2l belongs to the contracting institution. Ges2l operates the platform and processes that data to provide the service.

Data roles

The institution decides which users it links, which roles it assigns, which modules it uses, and which information it records in the platform.

Ges2l acts as the platform’s technical operator: it authenticates users, maintains sessions, enforces access controls, stores files, and keeps records required for operation, security, and support.

Data we may process

The exact data depends on each institution’s configuration and use.

• Identity data: names, surnames, identification type, and identification number.
• Account data: email, user status, roles, permissions, and active sessions.
• Contact and profile data: phone, address, location, demographic information, and profile picture when the institution or user records it.
• Academic data: students, guardians, teachers, groups, branches, subjects, enrollments, attendance, activities, recovery activities, assessment criteria, and scores.
• Institutional data: institutions, memberships, roles, academic years, branches, resources, files, and institution-level configuration.
• Technical data: necessary cookies, access logs, IP address, user agent, detected subdomain, audit events, usage metrics, and technical errors.

Data sources

Data may be provided by the user, by institutional administrators, by authorized coordinators or teachers, or generated automatically by the platform while the service is used.

The landing page also records cookie preferences and analytics events only when the visitor accepts optional cookies.

How we use data

• Create and administer institutional accounts.
• Authenticate users through Redis sessions, HttpOnly cookies, and JWTs for mobile or API clients.
• Apply roles, permissions, and access controls by institution and module.
• Manage academic and administrative processes requested by the institution.
• Store and serve institutional files or profile pictures through Cloudflare R2 when configured.
• Send operational communications through Resend when a product flow requires it.
• Audit activity, investigate incidents, measure API usage, and maintain platform security.
• Measure landing page campaigns or events through Cloudflare Zaraz only with visitor consent.

Multi-institution identity

A person may be linked to multiple institutions within Ges2l. Each institution independently manages its own link, roles, and access permissions.

The identification number may be used as a unique key to avoid duplicate records. If a person already exists in the system, their data may be reused to link them to another authorized institution within Ges2l.

Unlinking from an institution suspends access to that institution, but it does not necessarily delete personal data or affect active links with other institutions. An institution may reactivate a previously disabled link for re-entry or continuity of institutional processes.

Minors and education data

Ges2l includes academic modules for students, guardians, teachers, and coordinators. The institution is responsible for having the required authorizations to register and manage education data for students and guardians.

The platform applies institution and role-based access controls to limit which users can view or modify academic information.

Cookies and analytics

The landing page uses strictly necessary cookies to save preferences and support basic site operation.

Optional marketing and analytics cookies are activated only with explicit consent from the preferences panel. The documented integration for that measurement is Cloudflare Zaraz.

Vendors and infrastructure

The repository documents infrastructure using PostgreSQL for data, Redis for sessions and cache, Docker and Nginx for API deployment, Cloudflare Pages for frontends, Cloudflare R2 for files and backups, Resend for email, and Sentry as optional error tracking when a DSN is configured.

These vendors or components are used to operate the platform, deliver the service, maintain security, send operational email, store files, or diagnose errors. We do not sell personal data to third parties.

Security

Web authentication uses HttpOnly cookies and sessions stored in Redis. The API also supports JWTs for mobile clients or integrations.

Institutional queries must be filtered by institution, permissions are evaluated by role and module, and audit events are recorded for operational traceability.

Retention, unlinking, and deletion

Web sessions have a limited duration and are refreshed with user activity according to the authentication configuration.

Unlinking from an institution restricts access to that institution, but information may be retained when needed for academic, administrative, legal, audit, or service continuity obligations.

Permanent deletion requests are evaluated according to applicable legal retention obligations and may affect access to all linked institutions within the system.

Data subject rights

Users may request information about the use of their data, updates, corrections, proof of authorization, revocation of authorization, or deletion of data under Colombia’s Law 1581 of 2012 and other applicable regulations.

When data was recorded by an institution, the request may require validation or handling by the corresponding institutional controller.

Changes to this policy

This policy will be updated when vendors, retention practices, product modules, or applicable legal requirements change.

Relevant changes will be reflected on this page and may be communicated to institutional administrators when appropriate.