Personal data policy

This is an English translation provided for convenience. The Spanish version is the legally binding text.

Version 1.0 · Effective September 27, 2026

Nuvakto S.A.S. respects the privacy of everyone it works with. This policy explains what personal data we process, why, how we protect it and how you can exercise your rights. It is issued under Colombian Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and related regulations.

1. Data controller

Company: Nuvakto S.A.S.
Tax ID (NIT): 902.110.359-2
Address: Calle 75A # 66 - 50 Oficina 420, Bogotá D.C., Colombia
Personal-data contact: datos@nuvakto.com
Phone: 3103220648
Website: nuvakto.com

2. Principles

We apply the principles of lawfulness, purpose limitation, freedom, data quality, transparency, restricted access, security and confidentiality set out in Article 4 of Law 1581 of 2012. We collect only the data we need for a specific purpose, never use it for anything else, and protect it in proportion to the risk.

3. What we process and why

People who contact us: name, company, role, email, phone and your message, to answer your request, run the diagnostic, send the proposal you asked for and follow up. Marketing messages only with separate consent.
Clients and their staff: name, ID, role, contact details and signature of client representatives, to perform contracts, coordinate deliveries and support, invoice and meet legal obligations.
Suppliers and partners: contact, tax and banking details needed to contract and pay them.
Shareholders, staff, contractors and candidates: the data required by the corporate, employment or service relationship, or to evaluate an application.
Website visitors: we use no advertising cookies or third-party trackers. Our hosting provider may log technical data such as IP address for security purposes only.

4. Data we process on behalf of clients

When we build, migrate or operate a system, the client is the controller and Nuvakto acts as a processor. We process that data only on the client's written instructions, under a contract covering security, confidentiality, sub-processors and return or deletion of the data at the end of the service. We never use it for our own purposes.

5. Sensitive data and minors

We do not request sensitive data on our website or in our commercial relationship. If it were ever necessary, we would ask for explicit consent, which you are not required to give. We do not process data about children, except as a processor for a client who does so lawfully.

6. Your rights

You may access, update and correct your data; request proof of your consent; be informed of how your data is used; withdraw consent or request deletion where no legal or contractual duty requires us to keep it; access your data free of charge; and file complaints with Colombia's Superintendence of Industry and Commerce (SIC) after contacting us first.

7. How to exercise your rights

Write to datos@nuvakto.com with your name, ID, what you are requesting and where to reply. We answer requests for information within ten (10) business days, extendable by five (5). We resolve complaints within fifteen (15) business days, extendable by eight (8). If a complaint is incomplete we will ask you to complete it within five (5) business days; after two (2) months without a reply it is considered withdrawn.

8. Transfers

We use technology providers acting as processors for hosting, email and messaging, some with servers in the United States or the European Union. We share data with them only for the purposes of this policy, under contracts that require them to protect it. We never sell or rent your data, and we disclose it to authorities only under a legal order.

9. Security and retention

We protect data with role-based access and two-factor authentication, encryption where possible, verified backups and confidentiality agreements. Prospect data is kept for up to 24 months after the last contact; client, supplier and shareholder data for as long as commercial, accounting and tax law requires, generally ten years; data processed for clients for the period set in each contract. We will notify the SIC and affected people of security incidents where required.

10. Changes and effective date

We will publish substantial changes on this site before applying them and ask for new consent if a purpose changes. This policy is effective from September 27, 2026.