Personal Data Processing Policy

• Name: Engynex
• Email: contacto@engynex.com
• Phone and WhatsApp: +57 315 437 7743
• Website: https://engynex.com

This policy applies to personal data that Engynex processes as data controller and receives through the website, its contact, quote and support forms, WhatsApp, email, phone, social networks and in the course of its relationship with clients, prospects and suppliers.

When Engynex processes personal data on behalf of a client, as a data processor, the section Engynex as data processor applies.

For the purposes of this policy, and in accordance with Law 1581 of 2012 and Decree 1377 of 2013:

• Authorization: the data subject's prior, express and informed consent to the processing of their data.
• Privacy notice: a verbal or written communication informing the data subject of the existence of this policy, how to access it and the purposes of the processing.
• Database: an organized set of personal data subject to processing.
• Personal data: any information linked or that may be associated with one or more identified or identifiable individuals.
• Sensitive data: data affecting the data subject's privacy or whose misuse may lead to discrimination, such as racial or ethnic origin, political orientation, religious beliefs, trade union membership, health, sex life and biometric data.
• Data processor: a person who processes personal data on behalf of the data controller.
• Data controller: a person who decides on the database and the processing of the data.
• Data subject: the individual whose personal data is processed.
• Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
• Transfer: sending personal data to a recipient who is in turn a data controller, inside or outside Colombia.
• Transmission: communicating personal data to a processor, inside or outside Colombia, so that it processes them on behalf of the controller.

Engynex applies the principles of legality, purpose, freedom, accuracy or quality, transparency, restricted access and circulation, security and confidentiality set out in article 4 of Law 1581 of 2012.

Depending on the channel and the relationship, we may process the following data:

• Identification and contact data: name, company, job title, email, phone number, city and country.
• Request data: service or product of interest, estimated budget, message and any files you attach in the contact, quote or support forms.
• Conversations: the number, profile name and messages you exchange with us via WhatsApp, email, social networks or the site's live chat (for the latter, also the name, email or mobile you leave and the page you write from).
• Client and supplier data: ID document or tax ID (NIT), billing details, payment information and whatever is needed to perform the contract.
• Browsing data: preferences the site stores in your browser (light or dark theme and country) and technical data such as IP address, browser type and pages visited, which servers log for security. If you accept analytics cookies, we also record your journey through the site with a random identifier, and if you later write to us, that journey is linked to your request. Our use of cookies is explained in the Cookie Policy.

Card and PSE payments are processed through the relevant payment platforms, which handle financial data under their own policies.

We process personal data to:

• respond to information, contact and support requests;
• prepare quotes and commercial proposals;
• enter into and perform contracts, provide services, deploy products and manage invoicing, payments and collections;
• provide technical support and handle requests, complaints and claims;
• send information about Engynex services, products, news and events, from which you may ask to be removed at any time; on WhatsApp we only do so if you expressly accepted it in the form, and replying STOP is enough to stop receiving them;
• measure client satisfaction and improve our services;
• follow up on your request by email (at most three messages, which you can unsubscribe from with the link at the bottom) and, only if you authorized it, remind you of a form you left unfinished;
• prepare the first conversation with the help of artificial intelligence, which summarizes what you told us about your project; that reading makes no decision about you and does not change the priority our system assigns you;
• protect the security of the site, systems and information;
• produce internal statistics with aggregated or anonymized information;
• comply with legal, accounting and tax obligations and requests from competent authorities.

Engynex does not sell or rent personal data.

Engynex requests the data subject's authorization no later than when the data is collected, stating the purposes of the processing. Authorization may be given in writing, orally or through unequivocal conduct from which it can reasonably be concluded that it was given — for example, by ticking the acceptance box on a form or by starting a WhatsApp conversation after reading the Privacy Notice. Engynex keeps proof of the authorization.

Under article 10 of Law 1581 of 2012, authorization is not required for information requested by a public or administrative entity in the exercise of its legal duties or by court order; public data; medical or health emergencies; processing authorized by law for historical, statistical or scientific purposes; and data related to the Civil Registry.

As a data subject you have the right to:

• know, update and rectify your personal data, including partial, inaccurate, incomplete, fragmented or misleading data;
• request proof of the authorization given, except where the law does not require it;
• be informed, upon request, of how your data has been used;
• file complaints with the Superintendence of Industry and Commerce for breaches of the law, after exhausting the inquiry or claim process with Engynex;
• revoke the authorization and/or request deletion of your data when constitutional and legal principles, rights and guarantees are not respected. Revocation and deletion do not apply where there is a legal or contractual duty to remain in the database;
• access free of charge your personal data that has been processed.

These rights may be exercised by the data subject, their successors, their representative or attorney, and anyone designated by stipulation in favor of another.

You can exercise your rights by writing to contacto@engynex.com with the subject “Personal data”, or by phone and WhatsApp at +57 315 437 7743. Your request must include your name, ID document, a description of what you are requesting and a contact method for our reply. If you act on behalf of someone else, attach the document proving your representation.

Inquiries. If you want to know what information we hold about you, we will respond within a maximum of ten (10) business days from receipt. If it is not possible to respond within that period, we will tell you the reasons for the delay and the date of our response, which will not exceed five (5) business days after the first period expires.

Claims. If you believe your data should be corrected, updated or deleted, or you notice a breach of the law, you may file a claim, which will be handled as follows:

1. The claim must include your identification, a description of the facts giving rise to it, your address or contact method and any documents you wish to rely on.
2. If the claim is incomplete, we will ask you within five (5) business days of receipt to correct it. If two (2) months pass after our request without you providing the requested information, the claim will be deemed withdrawn.
3. If Engynex is not competent to resolve it, it will forward it to the appropriate party within two (2) business days and inform you.
4. Once the complete claim is received, we will add the note “claim in process” and the reason to the database within two (2) business days, and keep it until the claim is decided.
5. The maximum period to resolve the claim is fifteen (15) business days from the day after receipt. If it is not possible to resolve it within that period, we will tell you the reasons for the delay and the date it will be resolved, which will not exceed eight (8) business days after the first period expires.

You may only file a complaint with the Superintendence of Industry and Commerce after exhausting the inquiry or claim process with Engynex.

Engynex does not request sensitive data to provide its services. If it ever becomes necessary to process such data, we will explicitly tell you which data and for what purpose, request your express authorization and remind you that you are not required to authorize its processing or answer questions about it.

Our services are aimed at companies and adults, and we do not intentionally collect data from minors through the site.

When, in providing a service or product (for example, school platforms), Engynex processes minors' data on behalf of a client, it does so as a data processor, respecting the best interests of children and adolescents and their fundamental rights, in accordance with article 7 of Law 1581 of 2012 and its implementing rules. The client is responsible for obtaining authorization from their legal representatives.

To operate, Engynex may transmit personal data to providers acting as processors, such as web and cloud hosting, email, messaging, management tools, payment platforms and artificial intelligence providers (for example, Anthropic, which processes the text of your request to summarize it and does not use it to train its models), located in Colombia or abroad. Terms are agreed with them so that they process the data only according to our instructions and with adequate security measures.

Engynex will only transfer personal data to other countries that provide adequate levels of data protection or in the cases exempted by article 26 of Law 1581 of 2012. Data may also be provided to authorities that request it in the exercise of their legal duties.

When Engynex develops, hosts, maintains or supports sites, platforms or products for its clients, it may process personal data for which the client is the controller. In those cases Engynex acts as a processor: it processes the data only to provide the contracted service and according to the client's instructions, adopts security measures, maintains confidentiality and supports the client in handling data subjects' rights. Data subjects should address their requests to the client, as controller.

Engynex adopts reasonable technical, human and administrative measures to protect personal data against tampering, loss, and unauthorized or fraudulent consultation, use or access, such as access control, encrypted connections and backups. No system is completely infallible; if a security incident affecting personal data occurs, we will act to mitigate it and report it to the appropriate parties as required by law.

We keep personal data for as long as needed to fulfil the purposes for which it was collected, for the duration of the relationship with the data subject and for the periods required by legal, accounting, tax and commercial rules. Once those periods end, we securely delete or anonymize it.

This policy is effective from the last-updated date shown at the top of this document. Databases will be kept for as long as the processing purposes described remain.

Any substantial change to this policy will be communicated to data subjects in a timely manner, no later than when it is implemented, through the website or the contact details we hold. Where the change concerns the purposes of processing, we will request a new authorization.