Personal Data Processing Policy — Colombia

This Policy is adopted for the processing of personal data for which Digital Consulting Plus SAS acts as Data Controller (Responsable del Tratamiento) in Colombia.

This Policy is developed pursuant to the Colombian legal regime for the protection of personal data, including Statutory Law 1581 of 2012 (Ley 1581 de 2012) and its regulatory provisions compiled in Decree 1074 of 2015 (Decreto 1074 de 2015), as well as any provisions modifying or superseding them.

DCP SAS strives to apply the guiding principles of: legality; purpose; freedom; truthfulness or quality; transparency; restricted access and circulation; security; and confidentiality.

DCP SAS may process personal data pertaining to: prospective clients; active clients; client representatives; suppliers; business partners; independent contractors; commercial contacts; website visitors; service users where DCP SAS acts as Controller; and job applicants or personnel, when corresponding to internal human resource processes.

Categories of data processed may include: identification data; contact details; corporate or professional credentials; commercial and contractual records; billing and payment records; correspondence; technical browsing telemetry; consent logs and user preferences; and operational security audit trails.

Personal data may be processed for:

• responding to inquiries and contact requests;
• managing commercial and client relationships;
• preparing architectural proposals and quotes;
• executing and managing contracts;
• providing technical support;
• administering client and vendor accounts;
• invoicing, billing, and payment processing;
• carrying out accounting, tax, and administrative management;
• maintaining corporate and statutory records;
• sending communications related to contracted services;
• conducting authorized commercial outreach activities;
• managing IT systems security and resilience;
• preventing fraud, abuse, or unauthorized access;
• documenting verifiable consents and opt-outs;
• maintaining full traceability of customer interactions;
• analyzing, refining, and improving digital solutions;
• fulfilling statutory and regulatory mandates;
• responding to lawful orders issued by competent administrative or judicial authorities;
• establishing, exercising, or defending legal claims.

Where required by Colombian law, DCP SAS will obtain prior, express, and informed authorization from the Data Subject through a medium permitting subsequent verification. Authorization may be obtained through: physical or electronic forms; contractual agreements; digital checkboxes; electronic communications; and verifiable system audit records.

Pursuant to applicable law, the Data Subject is entitled to:

• know, update, and rectify their personal data;
• request proof of authorization granted, where legally applicable;
• be informed regarding the use made of their personal data;
• file complaints with the Superintendencia de Industria y Comercio once direct inquiries or claims before the Controller or Processor have been exhausted;
• revoke authorization and/or request data deletion when legally appropriate;
• access their processed personal data free of charge.

Inquiries and claims relating to data protection will be handled initially through:

Recommended subject line: “Personal Data — Inquiry / Claim”. DCP may subsequently designate a dedicated Data Protection Officer and update this Policy accordingly.

The Data Subject or authorized representative may consult personal data residing in databases controlled by DCP SAS. The request must include sufficient information to verify the identity of the applicant and specify the data subject to inquiry.

DCP SAS will address inquiries within the statutory deadlines established by Law 1581 of 2012. The general maximum timeframe is ten (10) business days from receipt. If it is not feasible to respond within this timeframe, the applicant will be informed of the reasons for delay and the new response date, which may not exceed five (5) additional business days, unless a special statutory rule applies.

The Data Subject or authorized representative may file claims to request correction, updating, or deletion of data, or to report an alleged breach. The claim must state: the applicant's identity; a clear description of the facts; contact information; the specific request; and supporting documentation where relevant.

If a claim is incomplete, DCP SAS may request rectification within the statutory time limits.

The general maximum timeframe for responding to complete claims is fifteen (15) business days starting from the business day following receipt. Where it is not feasible to provide a resolution within this timeframe, the applicant will be informed of the reasons for delay and the expected response date, which may not exceed eight (8) additional business days, unless a special statutory rule applies.

Data Subjects may request revocation of authorization or deletion of their personal data when legally appropriate.

Deletion is not mandatory when there is an existing legal or contractual obligation to retain the data, an active legal relationship, or other statutory exceptions recognized under Colombian law.

DCP SAS does not intentionally collect sensitive data through its general corporate website forms.

If a specific engineering engagement necessitates processing sensitive data, its necessity, lawful basis, purpose, and security safeguards will be evaluated beforehand. Where applicable, explicit consent will be obtained, informing the Data Subject that answering questions concerning sensitive data is voluntary, unless an express statutory exception applies.

DCP SAS does not direct its corporate website or B2B offerings to minors.

Where an enterprise project requires processing personal data of children or adolescents, DCP will apply statutory safeguards prioritizing their best interests, legitimate purposes, and verified parental or guardian authorizations.

DCP SAS may utilize data processors located within Colombia or in foreign jurisdictions to provide hosting, cloud infrastructure, CRM systems, email delivery, automation workflows, technical support, analytics, secure storage, payment gateways, AI tooling, or other essential enterprise services.

Where an international transmission or transfer of personal data occurs, DCP SAS will ensure compliance with the mandatory requirements established under Colombian data protection law.

DCP SAS may engage third-party service providers acting as Data Processors (Encargados del Tratamiento). Such vendors must process personal data strictly in accordance with documented instructions, contractual data processing agreements, and appropriate technical measures tailored to the nature of the service.

DCP SAS adopts reasonable technical, organizational, and physical safeguards to protect personal data against alteration, accidental loss, unauthorized consultation, use, access, or fraudulent disclosure.

All personnel and authorized contractors handling personal data are bound by strict professional confidentiality obligations.

This version does not contemplate routine video surveillance or biometric data processing through the corporate website. Should DCP SAS subsequently deploy such systems, appropriate signage, purpose notices, access controls, and policy updates will be implemented.

This Policy takes effect upon its official publication and production legal approval. The term of validity of databases maintained by Digital Consulting Plus SAS shall extend for the duration that is reasonable and necessary to fulfill the processing purposes authorized by data subjects, as well as to satisfy statutory, contractual, tax, accounting, and audit requirements under Colombian law.

DCP SAS reserves the right to amend this Policy to address regulatory, operational, or technical modifications. Material amendments will be published through reasonable public channels.