Privacy Notice

1. Notice

This Privacy Notice (the “Notice”) sets out the terms and conditions under which Servinformación will process your personal data in accordance with the principles and duties defined in Colombian Law 1581 of 2012, “which establishes general provisions for the protection of personal data,” and other applicable rules and regulations.

Servinformación is the data controller responsible for the processing of personal data. Address: Calle 84 # 24-78, Bogotá, Colombia. Website: www.servinformacion.com. Phone: (601) 256 2030. Email: habeasdata@servinformacion.com.

This Notice also applies to the processing of personal data of users who access the Holding Información Localizada Portal by signing in with their Google account, including data obtained through the Google APIs used by the platform.

2. Personal data we collect

To provide our services and operate the Portal, we collect the following categories of personal data:

• Identification and contact data you provide directly: first and last name, corporate email address, job title, area, and information about the organization you belong to.
• Data obtained when you sign in with Google (Google Sign-In / OAuth 2.0): email address, name, profile picture, and your unique Google account identifier, solely to authenticate your identity and create your session on the Portal.
• Corporate directory data (Google Workspace Admin Directory API, directory.user.readonly and directory.user scopes): when authorized by your organization, we query and, after a one-time manual migration review, may update basic directory information (name, job title, corporate phone, location, and manager) so the org chart stays aligned. Home address is managed only in the Portal. We do not access, read, or store the content of your email, Drive files, calendar, or any other Google data beyond what is strictly necessary for this purpose.
• Technical and usage data: IP address, browser type, device, access date and time, pages visited, and application events, collected automatically for security, support, and service-improvement purposes.
• Data derived from the provision of professional services: information about projects, assignments, training, evaluations, and performance, when you are a collaborator, contractor, or client of Servinformación.

3. Use of data obtained through Google APIs

Servinformación's access, use, and transfer of information obtained through Google APIs is limited exclusively to the purposes described in this Notice — authenticating your identity and validating access permissions — and complies with Google's API Services User Data Policy, including the Limited Use requirements.

In particular, Servinformación commits to: (i) not selling user data obtained from Google APIs; (ii) not using or transferring such data for advertising purposes; (iii) not allowing humans to read such data, except where necessary for security purposes, to comply with applicable law, or to operate the specific feature authorized by the end user; and (iv) not transferring such data to third parties, except as necessary to provide or improve the authorized user-facing features, and always in compliance with this Policy.

4. Purpose of processing

Your personal data will be collected by Servinformación to be included in our databases for the following purposes, without limitation:

• Authenticating your identity and managing secure access to the Holding Información Localizada Portal through Google Sign-In.
• Determining the permissions, roles, and scope of information you may access within the platform, according to your organization and job title.
• Sending correspondence, emails, or telephone contact to clients, suppliers, and users of our various programs, in connection with advertising, promotional, and marketing activities (primarily loyalty and relationship programs), sales execution, or market studies focused on the commercialization and distribution of goods and services or the provision of complementary services, as well as conducting satisfaction surveys regarding those goods and services.
• Information that allows us to determine and recognize commercial establishments nationwide, including their geographic location and the classification characteristics requested by our clients.
• Personnel selection, hiring administration, management of labor relationships and compliance with obligations arising therefrom, granting of employee benefits directly or through third parties, as well as enabling employee access to the company's IT resources, including this Portal.
• Transfer and transmission of data to third parties with whom we form alliances related to our corporate purpose, commission studies, or entrust with data processing. To banking institutions, health and pension administrators, and other related providers, for payment-processing purposes. To parties related to Servinformación for tax, accounting, and administrative verification, review, and certification purposes. To public authorities to which Servinformación is legally required to transfer information, or when officially required within their competencies.
• Responding to judicial or administrative requirements and complying with judicial or legal mandates.
• Maintenance, technical support, information security, and continuous improvement of our technology platforms.

5. Sharing, processors, and data transfer

Servinformación may share your personal data with data processors that provide services on its behalf, such as technology infrastructure and authentication providers (for example, Google LLC / Google Cloud Platform and Firebase Authentication), under contractual confidentiality and security obligations.

We do not sell or commercialize your personal data to third parties. Information is only transferred or transmitted in the cases described in Section 4 of this Notice, or when required by law or an order from a competent authority.

When data processors are located outside of Colombia, Servinformación will adopt the measures necessary to guarantee adequate levels of data protection, in accordance with Law 1581 of 2012 and its implementing decrees.

6. Data retention and security

Your personal data will be retained for as long as necessary to fulfill the purposes described in this Notice, as well as the periods required by applicable labor, accounting, tax, and commercial regulations. Once those periods have elapsed, the information will be securely deleted or anonymized.

Servinformación implements reasonable technical, human, and administrative measures to protect your personal data against unauthorized access, loss, alteration, or improper disclosure, including encryption in transit, role-based access control, authentication through Google (OAuth 2.0), and platform security monitoring.

7. Rights of the data subject

As the data subject, you have the right to:

• Access, free of charge, the data provided that has been subject to processing.
• Know, update, and rectify your personal data before the data controllers or processors. This right may be exercised, among other cases, with respect to partial, inaccurate, incomplete, fragmented, misleading data, or data whose processing is expressly prohibited or has not been authorized.
• Request proof of the authorization granted to the data controller, except when expressly exempted as a requirement for processing, in accordance with Article 10 of Law 1581 of 2012.
• Be informed by the data controller or processor, upon request, regarding the use given to your personal data.
• File complaints with the Superintendencia de Industria y Comercio (Colombia's data protection authority) for violations of Law 1581 of 2012 and other rules that modify, add to, or complement it.
• Revoke the authorization and/or request deletion of the data when the processing does not respect the constitutional and legal principles, rights, and guarantees. Revocation and/or deletion will proceed when the Superintendencia de Industria y Comercio has determined that the controller or processor has engaged in conduct contrary to the law and the Constitution.
• When sensitive personal data is collected, you are not obligated to answer questions concerning it, nor to authorize its processing.
• Revoke, at any time, the access granted to Servinformación from your Google account, through Google's security settings (myaccount.google.com/permissions), which will end your session on the Portal.

8. Cookies and similar technologies

The Portal uses strictly necessary cookies and browser local storage to keep your session active, remember your language preference, and ensure the platform operates securely. We do not use advertising cookies or third-party tracking for commercial purposes.

9. Minors

The Portal is intended for Servinformación's corporate collaborators, contractors, and clients, and is not intended for minors. We do not knowingly collect personal data from minors.

10. Changes to this Notice

Servinformación may update this Privacy Notice at any time to reflect regulatory, technological, or operational changes. The current version will always be available at this same address, indicating the date of the last update.

11. Mechanisms to learn about the processing policy

If you wish to submit an inquiry, complaint, or request for information related to the protection of your personal data, or request the update, rectification, or deletion of your data, you may:

• Send a written communication to Servinformación, Personal Data Protection, at Calle 84 # 24-78, Bogotá, Colombia.
• Send an email to habeasdata@servinformacion.com.
• Contact our support team through the channels available within the Portal.

12. Supervisory authority

As a data subject, you may file complaints and claims with the Superintendencia de Industria y Comercio of Colombia, the supervisory authority for personal data protection, when you believe Servinformación has engaged in conduct contrary to Law 1581 of 2012.