Personal Data Processing Policy

Identification of the data controller

INGENIAL acts as Data Controller for the personal data it collects directly, and as Data Processor when it processes data on behalf of its clients while delivering software projects.

Legal framework and scope

This Policy is issued in compliance with Article 15 of the Political Constitution of Colombia and the following regulations:

• Statutory Law 1581 of 2012, which sets out general provisions for the protection of personal data.
• Decree 1074 of 2015 (Single Regulatory Decree of the Commerce, Industry and Tourism Sector), Book 2, Part 2, Title 2, Chapters 25 and 26, which compiles Decrees 1377 of 2013 and 886 of 2014.
• Law 1266 of 2008, insofar as it applies to financial, credit and commercial data.
• The instructions of the Superintendence of Industry and Commerce (SIC), Colombia's national personal data protection authority.

This Policy applies to all personal data held in INGENIAL's physical or digital databases, collected through the website ingenial.com.co, email, forms, social media, meetings or any other channel. Compliance is mandatory for INGENIAL, its partners, employees, contractors and Data Processors.

Definitions

For the purposes of this Policy, the definitions in Article 3 of Law 1581 of 2012 and Decree 1074 of 2015 apply:

Processing principles

INGENIAL applies the principles set out in Article 4 of Law 1581 of 2012:

Data collected and channels

INGENIAL collects only the data necessary for the purposes described in this Policy, through these channels:

INGENIAL does not request sensitive data through the website. Data Subjects are asked not to include sensitive data or third-party data in the messages they send.

Processing and purposes

INGENIAL collects, stores, uses, updates, circulates and deletes personal data only for the following purposes, depending on the type of Data Subject:

Clients, prospects and website visitors

• Respond to requests, inquiries and messages sent through any channel.
• Prepare commercial proposals, quotes and meetings on software projects or talent allocation.
• Enter into, perform and manage contracts, including invoicing and payment management.
• Send commercial information, news and content about INGENIAL's services, only when the Data Subject has authorized it. The Data Subject may withdraw this authorization at any time.
• Measure website usage and improve its content and performance.

Candidates and technology professionals

• Carry out recruitment processes, assess professional profiles and verify candidates' education, work experience and technical skills.
• Manage opportunities to join technology projects and specialized talent services (staff augmentation).
• Present professional profiles and résumés to clients in Colombia or abroad, with the Data Subject's prior authorization where legally required and in accordance with the stated purposes.
• Contact candidates about future job opportunities or technology projects, when they have expressly authorized the retention and use of their data for that purpose.

Processing and retention of résumés

In the course of its recruitment processes and its provision of specialized technology talent services (staff augmentation), INGENIAL may collect, store, consult, update and use the personal and professional information contained in the résumés of candidates and professionals interested in job opportunities or technology projects.

This information will be used to assess professional profiles, manage recruitment processes, contact candidates and, where applicable and with the required authorization, present their profiles to clients in Colombia or abroad, without prejudice to the common purposes set out in this Policy.

Data retention

Résumés and associated personal data will be kept for as long as necessary to carry out the corresponding recruitment processes.

When a candidate expressly authorizes INGENIAL to keep their information for future opportunities, INGENIAL may retain it in its talent database for a maximum of 1 year from the last update of the information or the Data Subject's authorization, without prejudice to retention periods required by applicable legal or contractual provisions.

Once that period ends, INGENIAL will securely delete the information, unless there is a new authorization from the Data Subject or a legal obligation that justifies keeping it.

Updating and deleting data

Candidates may at any time request to access, update, correct or delete their personal data, and revoke the authorization granted for its processing, where legally applicable.

To exercise these rights, they may send a request to info@ingenial.com.co, stating their full name and the reason for the request.

INGENIAL will handle these requests in accordance with the procedure and timeframes set out in section 10 of this Policy.

Personal data will be deleted provided there is no legal or contractual obligation requiring it to be kept.

Employees and contractors

• Manage the employment or contractual relationship, the payment of salaries or fees and social security obligations.
• Comply with legal, tax and accounting obligations.

Suppliers

• Manage purchases, payments, evaluation and the contractual relationship.

Purposes common to all Data Subjects

• Comply with legal obligations and respond to requests from administrative or judicial authorities.
• Defend INGENIAL's rights in administrative or judicial proceedings.
• Retain information for the periods required by law.

INGENIAL does not sell, rent or assign personal data to third parties for commercial purposes. Any purpose other than those described here will require a new authorization from the Data Subject.

Authorization, sensitive data and minors

Authorization. INGENIAL requests the Data Subject's authorization no later than the moment their data is collected, informing them of the purposes of the Processing. Authorization may be given in writing, orally or through unequivocal conduct by the Data Subject that reasonably shows it was given, such as ticking the acceptance box on a form. Silence is not considered authorization. INGENIAL keeps proof of every authorization obtained.

Cases in which authorization is not required (Article 10 of Law 1581 of 2012):

• Information required by a public or administrative entity in the exercise of its legal functions or by court order.
• Data of a public nature.
• Medical or health emergencies.
• Processing authorized by law for historical, statistical or scientific purposes.
• Data related to the Civil Registry of Persons.

Sensitive data. INGENIAL does not collect sensitive data through the website. If a legal or employment obligation requires it to process such data, it will inform the Data Subject that they are not obliged to authorize its Processing or to answer questions about it, will indicate which data is sensitive and the purpose, and will obtain their express authorization, except for the exceptions in Article 6 of Law 1581 of 2012.

Children and adolescents. INGENIAL's services and website are intended for adults and businesses. Should it process data of persons under 18, it will do so respecting their best interests and fundamental rights, with the authorization of their legal representative and after the minor has exercised their right to be heard, in accordance with Article 7 of Law 1581 of 2012.

Rights of Data Subjects

Under Article 8 of Law 1581 of 2012, the Data Subject has the right to:

• Access, update and correct their personal data held by INGENIAL or its Data Processors, including partial, inaccurate, incomplete or fragmented data, data that is misleading, or data whose Processing has not been authorized.
• Request proof of the authorization granted, except where the law does not require it.
• Be informed, upon request, of how their data has been used.
• File complaints with the Superintendence of Industry and Commerce for violations of the law, once the inquiry or claim process with INGENIAL has been completed.
• Revoke the authorization and/or request the deletion of their data when the legal principles, rights and guarantees are not respected. Revocation or deletion does not apply when the Data Subject has a legal or contractual duty to remain in the database.
• Access their personal data under Processing free of charge, at least once every calendar month and whenever there are substantial changes to this Policy.

These rights may be exercised by the Data Subject, their successors, their duly accredited representative or attorney-in-fact, or anyone acting under a stipulation in favor of another.

Duties of INGENIAL

As Data Controller, and in accordance with Article 17 of Law 1581 of 2012, INGENIAL undertakes to:

• Guarantee the Data Subject the full and effective exercise of the right of habeas data.
• Request and keep a copy of the authorization granted by the Data Subject.
• Inform the Data Subject of the purpose of the collection and the rights they hold.
• Keep information under security conditions that prevent tampering, loss, consultation, use or unauthorized or fraudulent access.
• Ensure that the information it provides to Data Processors is truthful, complete, accurate, up to date and understandable, and notify them of any changes.
• Correct information when it is inaccurate.
• Require Data Processors to respect the security and privacy conditions of the Data Subject's information.
• Handle inquiries and claims under the terms of this Policy and the law.
• Report when certain information is being disputed by the Data Subject, once a claim has been filed and the process has not concluded.
• Inform the Superintendence of Industry and Commerce of any breaches of security codes and risks in the management of Data Subjects' information.
• Comply with the instructions and requirements of the Superintendence of Industry and Commerce.

When INGENIAL acts as a Data Processor on behalf of its clients, it will comply with the duties in Article 18 of the same law and will process data only according to the instructions of the client acting as Data Controller.

Responsible area and procedure for inquiries and claims

The area responsible for handling requests, inquiries and claims is INGENIAL's Administrative Department, through info@ingenial.com.co or in writing at the physical address in Quimbaya, Quindío, Colombia. The request must state the Data Subject's name and ID, the preferred means of receiving a response and, if a third party is acting, the document that accredits them.

Claim requirements and rules

• The claim must include the Data Subject's identification, a description of the facts, the address for notification and any supporting documents.
• If the claim is incomplete, INGENIAL will ask the claimant to correct it within 5 days of receipt. If 2 months pass after this request without a response, the claim will be considered withdrawn.
• If INGENIAL is not competent to resolve it, it will forward the claim to the appropriate party within a maximum of 2 business days and inform the claimant.
• Once a complete claim is received, the note "claim in progress" and the reason will be added to the database within a maximum of 2 business days, until it is resolved.

Procedural requirement. The Data Subject may file a complaint with the Superintendence of Industry and Commerce only after completing the inquiry or claim process with INGENIAL (Article 16 of Law 1581 of 2012).

Processors, transmission and international transfer

Transmission of data to technology providers. INGENIAL uses technology providers that may store or process personal data on its behalf, including web hosting, email, online forms, web analytics tools and other platforms needed for its activities.

Some of these providers may have technology infrastructure or servers located outside Colombia.

When these providers act as Data Processors, INGENIAL will set the corresponding contractual terms to ensure personal data is processed according to its instructions, under adequate security and confidentiality measures, in accordance with Articles 2.2.2.25.5.1 and 2.2.2.25.5.2 of Decree 1074 of 2015.

National and international transfers of personal data. In the course of its commercial activities and technology services, INGENIAL may transfer personal data to clients or third parties in Colombia or abroad, provided there is a legitimate purpose, the applicable legal requirements are met and the Data Subject's authorization is obtained where required.

International transfers will be carried out in accordance with Article 26 of Law 1581 of 2012 and its implementing regulations, taking into account the data protection conditions of the receiving country, the exceptions provided by law and any applicable declarations of conformity.

INGENIAL will distinguish between transmission and transfer of personal data according to the role and responsibility of the parties involved, in line with the definitions in section 3 of this Policy.

Data processing in specialized talent services (staff augmentation). In providing specialized technology talent services, INGENIAL may share candidates' professional information with clients in Colombia or abroad, including résumés, education, work experience, technical skills and contact details.

This processing will be carried out in accordance with the purposes set out in section 6 of this Policy, with the Data Subject's prior authorization where legally required, and in compliance with the requirements applicable to the circulation, transmission or transfer of personal data.

Confidentiality and protection measures. INGENIAL will adopt reasonable technical, human, administrative and contractual measures to protect personal data shared with clients, technology providers and other authorized third parties.

Personal information will be processed only for legitimate and authorized purposes, respecting the principles of security, confidentiality, restricted access and limited circulation established in Colombian law.

INGENIAL will not sell or rent personal data to third parties for commercial purposes, without prejudice to sharing it with clients or providers when necessary and legally appropriate for the provision of its services.

Cookies and web analytics technologies

The website ingenial.com.co uses cookies and analytics technologies to ensure it works properly, understand how visitors interact with its content and improve the browsing experience.

INGENIAL uses Google Analytics 4 (GA4) to measure and analyze website traffic.

To manage visitors' privacy preferences, the site implements Google Consent Mode v2 in its basic mode, under which Google analytics tags remain blocked until the user gives consent.

• Visitors can accept or reject analytics cookies through the consent notice available on the website.
• Rejecting analytics cookies does not prevent access to the site's content or general features.

Users can find more information about the categories of cookies used, their purposes and how to manage their preferences in INGENIAL's Cookie Policy.

Personal data obtained through these technologies will be processed in accordance with applicable Colombian personal data protection law.

Security, retention and database registration

Security. INGENIAL adopts reasonable technical, human and administrative measures to protect data, such as per-user access control, passwords, access limited to staff who need it and confidentiality agreements with employees and contractors. If a security incident affecting personal data occurs, INGENIAL will report it to the Superintendence of Industry and Commerce under the terms that authority establishes.

Database retention. Data will be kept for as long as necessary to fulfil the purposes of this Policy, for as long as there is a commercial, employment or contractual relationship with the Data Subject, and for the periods required by accounting, tax, labor or commercial regulations. Once those periods end, or when the Data Subject requests it and there is no legal or contractual duty to keep it, the data will be securely deleted.

For résumés of candidates and technology professionals, the specific retention period set out in section 6 of this Policy applies, without prejudice to legal or contractual obligations that justify a different retention period.

National Database Registry (RNBD). INGENIAL will register its databases in the RNBD managed by the Superintendence of Industry and Commerce when required to do so. This obligation currently applies to companies with total assets above 100,000 UVT, under Decree 1074 of 2015 as amended by Decree 090 of 2018.

Data Subject responsibility, changes and effective date

Information provided by the Data Subject. The Data Subject guarantees that the data they provide is truthful and their own, or that they are authorized to share third-party data. INGENIAL is not responsible for the inaccuracy of information provided by the Data Subject, nor for the use third parties make of data the Data Subject has made public.

Changes. INGENIAL may amend this Policy. Substantial changes, especially those concerning the identification of the Data Controller or the purpose of the Processing, will be communicated to Data Subjects through the website or by email before they are implemented. If the purpose of the Processing changes, INGENIAL will obtain a new authorization.

Effective date. This Policy is effective from October 15, 2026 and will remain in force for as long as INGENIAL processes personal data.

Annex

Authorization for contact and project planning forms

Authorization for commercial communications

Authorizations for candidates and technology professionals

When INGENIAL collects résumés through digital forms, it must include the following authorizations as applicable:

Exercising rights

Data Subjects may access, update, correct and request the deletion of their personal data, and revoke their authorization where applicable, by writing to info@ingenial.com.co, following the procedure set out in section 10 of this Policy.