Personal data processing policy

• Legal entity: Cardanel Technologies S.A.S.
• Trade name: Cardanel
• Tax ID (NIT): 902.105.762-8
• Registered address: [Registered office address, to be added]
• Country: Colombia
• Contact for data protection matters: legal@cardanel.com

• Personal data: any information linked to or that can identify one or more natural persons.
• Data subject (Titular): the natural person to whom the personal data relates.
• Data controller (Responsable del Tratamiento): the person or entity that decides the purposes and means of processing personal data, namely Cardanel Technologies S.A.S., as described above.
• Data processor (Encargado del Tratamiento): a person or entity that processes personal data on behalf of the data controller, such as an infrastructure or email delivery provider.
• Processing (Tratamiento): any operation performed on personal data, such as collection, storage, use, circulation, or deletion.
• Authorization: the prior, express, and informed consent of the data subject to process their personal data.

This Policy is issued under:

• Article 15 of the Colombian Constitution, which protects the right to personal and family privacy and to know, update, and correct information collected about oneself.
• Law 1581 of 2012, the general data protection statute (Habeas Data), and its implementing Decree 1377 of 2013.
• Decree 1074 of 2015 (Single Regulatory Decree for the Commerce, Industry and Tourism Sector), which compiles Decree 1377 of 2013.
• The guidance and binding circulars issued by the Superintendencia de Industria y Comercio (SIC), the Colombian data protection authority.

Cardanel processes personal data submitted through this website for the following purposes:

• To respond to demo requests and follow up with information relevant to the request.
• To manage the commercial relationship with prospective and existing customers.
• To operate, secure, and improve the website.
• To comply with legal, accounting, tax, and regulatory obligations.
• To exercise or defend against legal claims.

We do not process sensitive personal data (as defined under Law 1581 of 2012) through this website, and we do not use personal data for purposes other than those listed above without first obtaining the data subject's authorization.

In accordance with Article 8 of Law 1581 of 2012, every data subject has the right to:

• Know, update, and rectify their personal data.
• Request proof of the authorization granted to Cardanel, except where authorization is not required by law.
• Be informed, upon request, about the use given to their personal data.
• File complaints with the Superintendencia de Industria y Comercio for violations of Law 1581 of 2012, after exhausting the request procedure with Cardanel described below.
• Revoke their authorization and/or request deletion of their personal data, where its processing does not comply with applicable law or is no longer necessary or required.
• Access their personal data free of charge.

Data subjects may exercise their rights by sending a request to legal@cardanel.com, identifying themselves and clearly describing the request.

Consultas (queries)

Requests to know what personal data Cardanel holds about the requester will be answered within ten (10) business days of receipt. If it is not possible to respond within that period, we will inform the requester of the reasons before the deadline expires and provide a new response date, which shall not exceed five (5) additional business days.

Reclamos (claims)

Requests to correct, update, or delete personal data, or requests alleging non-compliance with Law 1581 of 2012, will be resolved within fifteen (15) business days of receipt. If more time is needed, we will inform the requester before that deadline expires, stating the reasons and the new response date, which shall not exceed eight (8) additional business days.

If the request is incomplete, we will ask the requester to correct it within five (5) business days of the request. If two (2) months pass without the requester submitting the required information, the request will be considered withdrawn.

If a data subject considers that their rights have not been respected after following this procedure, they may file a complaint with the Superintendencia de Industria y Comercio (Delegatura para la Protección de Datos Personales).

Personal data collected through this website is retained for as long as necessary to fulfill the purposes described in section 4, plus any additional period required to comply with legal, accounting, or tax retention obligations, or to resolve disputes. After that, the data is deleted or anonymized.

Cardanel applies technical, administrative, and organizational measures reasonably designed to protect personal data against loss, unauthorized access, alteration, or misuse, including encrypted transmission, restricted access limited to personnel who need it, and the use of reputable infrastructure and email providers acting as data processors under contractual confidentiality and security obligations.

Some of the service providers Cardanel uses to operate this website, such as hosting and email delivery infrastructure, may process data on servers located outside Colombia. Where this occurs, it is treated as an international transmission to a data processor acting on Cardanel's instructions, and Cardanel takes reasonable steps to ensure those providers offer an adequate level of protection consistent with Colombian data protection law, including through contractual safeguards.

This Policy is effective as of the date shown above and will remain in force until it is replaced by an updated version. We will update the date at the top of this page whenever this Policy changes.