Personal Data Processing Policy

1. Purpose and legal framework

This policy is issued in compliance with Law 1581 of 2012, Decree 1074 of 2015 (which compiled Decree 1377 of 2013) and the other concordant rules, and governs the processing of personal data that Geart S.A.S. carries out as controller, in order to guarantee the constitutional right of habeas data.

2. Identification of the controller

• Legal name: Geart S.A.S., trading under the brand Articod Digital Lab.
• NIT: 901.217.669-8
• Registered address: Cra 90 # 83 - 26 Int 7, Bogotá D.C., Colombia
• Phone: +57 312 307 0304
• Email: [email protected]

3. Definitions

• Data subject: the natural person whose personal data is being processed.
• Personal data: any information linked to, or that can be associated with, an identified or identifiable natural person.
• Sensitive data: data that affects the subject's privacy or whose misuse may lead to discrimination.
• Processing: any operation on personal data, such as collection, storage, use, circulation, or deletion.
• Authorization: the data subject's prior, express, and informed consent to the processing.
• Processor: whoever carries out the processing on the controller's behalf.
• Database: an organized set of personal data subject to processing.

4. Databases and data processed

Geart S.A.S. maintains databases of prospects and customers (contacts at companies that request information or contract our services), of suppliers, and of staff. Only the first is fed through the website.

The data processed covers professional identification and contact details, information about the commercial request, and browsing data. We do not process sensitive data or data about minors.

5. Purposes of the processing

• To manage requests for information and sales opportunities.
• To prepare proposals and quotes.
• To deliver and perform the services contracted.
• To invoice and manage the contractual relationship.
• To send commercial and informational communications where authorization exists.
• To comply with legal, accounting, and tax obligations.
• To respond to requests from the competent authorities.

6. The data subject's authorization

Authorization is obtained in advance, expressly and on an informed basis, through the acceptance box in our web forms, the acceptance of a commercial proposal, or any other means that lets us keep proof of it. The data subject may withdraw it at any time by writing to [email protected], unless a legal or contractual duty requires us to keep the information.

7. Rights of data subjects

Under article 8 of Law 1581 of 2012, the data subject has the right to:

• Know, update, and correct their personal data.
• Request proof of the authorization given.
• Be informed about the use made of their personal data.
• File complaints with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio).
• Withdraw the authorization and request deletion of the data.
• Access their personal data free of charge.

8. Duties of the controller

Geart S.A.S. takes on, among others, the duties set out in article 17 of Law 1581 of 2012: guaranteeing the exercise of habeas data, keeping proof of the authorization, informing the data subject of the purpose of the processing, keeping the information under secure conditions, updating and correcting the data where appropriate, handling inquiries and complaints within the legal deadlines, and reporting breaches of the security codes to the authority.

9. Area responsible for handling requests

The area in charge of handling data subjects' petitions, inquiries, and complaints is the Administrative Department of Geart S.A.S., reachable at [email protected] and by phone at +57 312 307 0304.

10. Procedure for inquiries and complaints

Inquiries. The data subject or their successors may ask about the information held in our databases. An inquiry is answered within ten (10) business days at most. Where that is not possible within that period, we will tell the person concerned and resolve it no later than five (5) business days after the first period expires.

Complaints. Where the data subject believes the information should be corrected, updated, or deleted, or sees an apparent breach, they may file a complaint, which will be handled within fifteen (15) business days at most, extendable by a further eight (8) business days, with the reasons for the extension communicated beforehand.

If the complaint is incomplete, we will ask the person concerned within the following five (5) days to complete it. If two (2) months pass without the requested information, the complaint will be understood as withdrawn.

The request should be addressed to [email protected] and include the data subject's full name, the contact details for our answer, a description of the facts, and any documents they wish to rely on.

11. National Database Registry

Under Decree 090 of 2018, the duty to register databases in the National Database Registry (RNBD) of the Superintendence of Industry and Commerce applies only to companies and non-profit entities whose total assets exceed 100,000 UVT. Geart S.A.S. is below that threshold, so it is not required to register, without prejudice to complying with every other duty set out in Law 1581 of 2012.

12. Security measures

We apply technical, human, and administrative measures to keep the information secure and prevent it from being tampered with, lost, consulted, used, or accessed without authorization: encryption in transit, role-based access control, backups, and confidentiality clauses with staff and providers.

13. Effective date

This policy has been in force since September 3, 2026. The databases maintained by Geart S.A.S. will be kept for as long as the commercial relationship with the data subject lasts, and for the additional periods required by the applicable accounting, tax, and commercial rules.

Questions about this document? Write to us at [email protected].