This English version is a courtesy translation. If it differs from the Spanish version, the Spanish version governs.

What this page is for

This page explains how you can exercise your rights over your personal data and how Certia looks after it, both on this site and in the services it provides to financial institutions and other companies. What the site collects is detailed in our Privacy policy.

Your rights as a data subject

Ecuador's Organic Law on Personal Data Protection (LOPDP) lets you:

Know which of your data we process and get a copy (access).
Correct inaccurate data or complete what is missing (rectification and update).
Ask us to delete your data when it is no longer needed or you withdraw your consent (deletion).
Object to a specific use, such as receiving marketing emails (objection).
Receive your data in a structured, commonly used format, or ask us to send it to another controller (portability).
Ask us to stop using your data while its accuracy is checked or a complaint is resolved (suspension of processing).
Not be subject to decisions based solely or partly on automated assessments that produce legal effects or affect your rights, and ask for a reasoned explanation of the decision.

We do not charge you for handling your request.

How to send a request

Use the form on this page: say which right you want to exercise, which data it concerns and how you would like us to reply. When you send it, the request goes straight to the team that handles it. If you prefer, write to certia@fidelity-ec.com with the subject "Protección de datos".

Before acting, we verify that you are the data subject or their representative, so we never hand over or change someone else's data. We answer within 15 days, the period set by the LOPDP. If you are not satisfied, you can file a complaint with the Superintendency of Personal Data Protection.

When Certia works for an institution

In services such as credit origination, customer service, collections, identity verification or fraud prevention, Certia usually processes data on behalf of a client institution, such as a bank, a credit cooperative or an insurer. In those cases the institution is the controller and Certia acts as its processor: it uses the data only according to the institution's instructions and the signed contract.

If you are a customer of one of those institutions, send your request to the institution. If it reaches us, we forward it without delay and support the institution with the technical information it needs to answer you on time.

Principles we apply

Legality: we process data only when there is a valid legal basis.
Purpose: we use data for specific, explicit purposes that we state when we collect it.
Proportionality: processing must be suitable and necessary for its purpose.
Minimization: we ask only for the data we need.
Confidentiality: access is limited to people who need it for their work, under confidentiality agreements.
Quality and accuracy: we keep data correct and up to date, and fix whatever you point out.
Retention: we keep data only as long as necessary and then delete or anonymize it.

Impact assessment

Before starting processing that may pose a high risk to people, such as an automated assessment that influences credit decisions, an impact assessment must be carried out, as the LOPDP requires. When the client institution is the controller, we support it with the technical description of the service, the risks identified and the measures to reduce them.

Automated decisions

When our systems support decisions about people, such as a credit pre-qualification or a fraud alert, we design them so that someone at the institution can review the result, explain the criteria used and consider your comments.

Data protection officer

Certia is committed to keeping a designated person responsible for personal data protection. That role coordinates internal compliance, reviews new processing activities and handles the requests that arrive at certia@fidelity-ec.com.

If a security breach occurs

If a breach affects data for which we are the controller, we notify the Superintendency of Personal Data Protection as soon as possible, and no later than the five-day period set by the LOPDP from the moment we become aware of it. Since its May 2026 amendment, the law also requires informing the competent supervisory body and the relevant incident response team (CSIRT).

If the breach poses a risk to your rights, we notify you within three days, with a clear explanation of what happened and what we recommend you do.

When we act as a processor, we notify the institution that is the controller within two days, so it can meet its own obligations.

More information

The technical measures we apply are described in Information security.