Personal Data Processing Policy

1. Data controller

GTi Risk S.A.S., tax identification number (NIT) 901.159.645-2, is responsible for deciding how personal data received for its investigation and risk management activities in Colombia is processed.

Registered address: Calle 107 A # 8-23, Usaquén, Bogotá D.C., Colombia. Data protection email: consultores@risk-gti.org. Telephone: +573143736489. These channels accept inquiries and complaints free of charge.

2. Scope and data we collect

This policy governs the collection, storage, use, disclosure and deletion of personal data by GTi Risk under Colombian Law 1581 of 2012 and Decree 1377 of 2013, compiled in Decree 1074 of 2015.

The contact form requests your name, telephone number, email address, service of interest and message, and records your processing authorization. We request only information needed to handle your request. Please do not include sensitive data or third-party information in your initial message.

Additional data may be needed when contracting and delivering a service. Before collecting it, we will explain the relevant categories and purposes and obtain authorization where required. Anyone providing third-party information must have a lawful basis to disclose it; this does not replace GTi Risk’s own duties.

3. Purposes and authorization

We use data to answer inquiries, contact the requester, prepare and send quotations, assess and deliver the contracted service, manage the contractual relationship and meet legal obligations. We do not sell personal data or treat an inquiry as authorization for unsolicited advertising.

The form requests prior, express and informed authorization through a checkbox. We retain evidence of authorization according to the means used. Silence does not constitute consent. Any different use requiring authorization will be explained and authorized in advance, unless a legal exception applies.

4. Sensitive data and children’s data

Some investigations may involve sensitive data, such as health information, biometric data, ethnic origin, beliefs or sex life. We will process it only with the data subject’s explicit authorization and under applicable legal conditions. We will explain its sensitive nature and specific purpose before requesting it. Answering questions about this data is optional; we do not make an activity conditional on providing it.

The form is not intended for children. Any necessary processing of children’s or adolescents’ data must respect their best interests and fundamental rights, obtain their representative’s authorization and take their views into account according to their maturity and autonomy.

5. Your rights

You may know and access your data free of charge, update and correct it, request evidence of your authorization, receive information about how it is used, request deletion and withdraw authorization where applicable. Deletion or withdrawal does not apply while a legal or contractual duty to retain the data remains.

You may also file a complaint with Colombia’s Superintendence of Industry and Commerce (SIC) after completing the inquiry or complaint procedure with the controller or processor. You do not need to hire an intermediary to exercise these rights.

6. How to submit inquiries and complaints

Write to consultores@risk-gti.org with the subject “Personal data protection”, or submit your request at our address. Include your name, a reply channel, the relevant data or facts, what you are requesting and any supporting documents. We will verify identity or representation proportionately and securely. Data subjects, their successors and duly accredited representatives may submit requests.

Inquiries: we will respond within 10 business days of receipt. If this is not possible, before that period expires we will explain the reason and give a new response date, with an extension of no more than 5 business days.

Complaints: we will respond within 15 business days starting on the day after receipt. If an extension is needed, we will explain the reasons and response date before the deadline, with no more than 8 additional business days.

If a complaint is incomplete, we will request the missing information within 5 days of receipt. If 2 months pass after that request without completion, the complaint will be treated as withdrawn. If we lack authority to handle it, we will forward it to the appropriate party within 2 business days and notify the requester. Once complete, we will mark the database record “complaint in progress” with the reason within 2 business days, until resolution.

7. Processors and international data flows

We use Netlify to host the website, Resend to send contact form messages and Google Workspace for email and business collaboration. These providers may process or store information outside Colombia. We share only the information necessary for their role.

When a provider processes data on our behalf, domestic or international transmission will be governed by a contract defining scope, instructions, security and confidentiality under Decree 1074 of 2015. A transfer to another controller may take place only in accordance with Article 26 of Law 1581 of 2012, including applicable exceptions or authorizations. Acceptance of this policy does not remove these safeguards.

8. Security, confidentiality and retention

We apply technical, human and administrative measures appropriate to the information to prevent loss, alteration, unauthorized access or use. We restrict access to personnel and providers who need it for their duties and require confidentiality. No system guarantees absolute security; incidents will be managed and reported according to applicable obligations.

We retain data for as long as necessary to handle the request, perform the contract, comply with legal retention periods or defend rights. Once those purposes and obligations end, we securely delete or anonymize the information. You may request information about retention of your data through the channels above.

9. Effective date and changes

This policy takes effect on November 3, 2026. Databases will remain in existence as needed for the purposes and obligations described. Updates will be published here; material changes will be communicated in good time before implementation, and fresh authorization will be requested where required.