Privacy Policy — Personal Data Processing Policy

Version: 1.1
Date this web copy was updated: October 11, 2026
Data Controller: Santiago Castaño Patiño
Contact for inquiries and complaints: info@nerdico.co · WhatsApp +57 320 526 6808

1. Identification of the Data Controller

Nérdico is a natural person operating under the Nérdico brand and provides technology services, systematization, digital transformation, automation, training, and business support.

For the purposes of this Policy, Nérdico shall act as the Data Controller when it determines the purposes and means of the processing of personal data.

Identification information

The Data Controller is identified as a natural person. The tax identification number (NIT) reported for the Data Controller is 1053806278-4; its correspondence with the RUT record should be retained in Nérdico's internal identification records.

2. Purpose

This Policy establishes the criteria under which Nérdico collects, stores, uses, consults, organizes, retains, circulates, transmits, transfers and, where applicable, deletes personal data.

Its purpose is to ensure that processing is carried out in accordance with the Political Constitution of Colombia, Law 1581 of 2012, its regulations in force, and other applicable laws, instructions, and criteria.

The Policy also seeks to integrate data protection into Nérdico's actual operations: WEB → CRM → HELPDESK → CLIENTS → PROJECTS → SUPPORT → AUTOMATIONS → AI → CONTRACTS → AGENTS → DOCUMENTATION.

3. Legal framework

This Policy is primarily based on:

• The Political Constitution of Colombia, particularly Article 15.
• Statutory Law 1581 of 2012, which establishes general provisions for the protection of personal data.
• Decree 1377 of 2013, in the provisions that remain in force, and its consolidated or amended provisions.
• Sole Regulatory Decree 1074 of 2015, particularly the provisions on personal data protection and the National Database Registry.
• Decree 090 of 2018 and other rules governing the scope and conditions of the National Database Registry (RNBD).
• Decree 255 of 2022, regarding Binding Corporate Rules and any provisions that may apply.
• Current instructions, circulars, and legal doctrine of the Superintendence of Industry and Commerce (SIC).
• Any other rules that amend, supplement, replace, or regulate the applicable framework.

The Policy must be updated whenever a relevant legal, judicial, or regulatory change occurs.

4. Scope

This Policy applies to personal data processed by Nérdico through any physical, electronic, digital, automated, or non-automated means, including information processed through third parties when Nérdico is the Data Controller or when the applicable contractual and legal obligations apply to it as a Data Processor.

It may include, among others:

• prospects and business contacts;
• customers and their representatives, administrators, employees, or contacts;
• suppliers and partners;
• contractors and collaborators;
• candidates, where applicable;
• users and visitors to websites and digital channels;
• people who contact Nérdico by email, WhatsApp, telephone, forms, or other channels;
• CRM and Helpdesk users;
• people involved in implementation, support, maintenance, and training projects;
• information contained in documents, files, and systems managed by Nérdico;
• information processed through automations, integrations, and artificial intelligence tools;
• personal data to which Nérdico gains access on behalf of a customer when acting as a Data Processor.

Processing must be assessed according to its purpose and Nérdico's legal role in each process.

5. Main definitions

For this Policy, the applicable legal definitions include, among others:

Personal Data: any information relating to, or that may be associated with, an identified or identifiable natural person.

Data Subject: the natural person whose personal data are subject to Processing.

Processing: any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.

Data Controller: the person who decides on the database and/or the Processing.

Data Processor: the person who carries out Processing on behalf of the Data Controller.

Authorization: the Data Subject's prior, express, and informed consent to carry out Processing, except where a legal exception applies.

Sensitive Data: data that affect the Data Subject's privacy or whose improper use may result in discrimination, including, among others, data relating to health, sex life, biometric data, racial or ethnic origin, political orientation, religious or philosophical beliefs, and trade union membership.

Transfer: the communication of data to another Data Controller.

Transmission: the communication of data so that a Data Processor may process it on behalf of the Data Controller.

These definitions shall be interpreted in accordance with the legislation in force.

6. Nérdico's roles: Data Controller and Data Processor

Nérdico shall not automatically assume the same legal role for all its services.

6.1. Nérdico as Data Controller

Nérdico shall be the Data Controller when it determines the purposes and means of Processing. This may occur, for example, in relation to its own information concerning:

• prospects;
• customers;
• suppliers;
• collaborators;
• business contacts;
• users of its channels;
• administrative management;
• billing;
• security;
• business relationships;
• business communications.

6.2. Nérdico as Data Processor

Nérdico may act as a Data Processor when it processes personal data on behalf of a customer or another Data Controller, following that party's instructions.

This may occur in services involving:

• technology support;
• system administration;
• CRM;
• Helpdesk;
• POS;
• information migration;
• automations;
• integrations;
• storage;
• maintenance;
• solution implementation;
• AI tools;
• other services in which Nérdico accesses customer data on that customer's behalf.

In these cases, Processing must be limited to the instructions, purposes, and scope authorized by the Data Controller, in addition to the applicable legal and contractual obligations.

7. Processing principles

Nérdico shall apply the principles established by the Colombian personal data protection framework:

7.1. Legality

Processing shall be subject to the applicable legal provisions.

7.2. Purpose

Data shall be processed for legitimate, specific, explicit purposes that have been disclosed in advance where applicable.

7.3. Freedom

Except where a legal exception applies, Processing shall require the Data Subject's prior, express, and informed Authorization.

7.4. Accuracy or quality

Information must be truthful, complete, accurate, up to date, verifiable, and understandable.

7.5. Transparency

The Data Subject may request information about the existence of data concerning them and how such data have been used, in accordance with the law.

7.6. Restricted access and circulation

Access shall be limited to authorized persons, legally authorized third parties, and those who need it for a legitimate purpose.

7.7. Security

Nérdico shall adopt reasonable technical, human, and administrative measures proportionate to the risk to prevent unauthorized or fraudulent alteration, loss, consultation, use, or access.

7.8. Confidentiality

Persons involved in Processing must maintain the confidentiality of personal information that is not public in nature, including, where applicable, after their relationship with Nérdico has ended.

7.9. Necessity and minimization

As an operational criterion, Nérdico shall not collect personal data merely because a tool makes it possible to store them.

Before creating a field, form, or record, the following must be assessed:

1. what data are needed;
2. for what purpose;
3. who needs access;
4. for how long;
5. where the data will be stored;
6. what risk their exposure entails;
7. whether the purpose can be achieved with less information.

8. Purposes of Processing

The applicable purposes shall depend on the type of Data Subject, the service, and Nérdico's role.

Purposes that may apply include:

8.1. Business relationship

• responding to requests for information;
• managing prospects and opportunities;
• carrying out discovery and diagnostic processes;
• preparing proposals;
• managing negotiations and closings;
• maintaining the business relationship;
• managing renewals and future needs;
• sending communications related to the business relationship;
• managing referrals, where applicable.

8.2. Service delivery

• performing contracts;
• coordinating projects;
• carrying out implementations;
• providing support and maintenance;
• managing tickets;
• administering users and permissions;
• providing training;
• documenting deliverables;
• verifying operation;
• handling warranties and incidents;
• providing automation, integration, systematization, and AI services.

8.3. Business administration and management

• billing and accounts receivable;
• accounting and financial management;
• supplier and partner administration;
• contract management;
• management of collaborators and contractors;
• information security;
• incident prevention and response;
• auditing;
• risk management;
• compliance with legal obligations.

8.4. Prospecting and commercial communications

Nérdico may manage prospects and carry out commercial prospecting to offer its technology, systematization, digital transformation, automation, training, and business support services, provided that the Processing of personal data has a valid legal basis and respects the disclosed purposes, the Data Subject's rights, and the rules applicable to each channel.

To collect personal data directly—for example, through web forms, events, referrals, or conversations—Nérdico shall disclose the purposes and identify the Authorization mechanism where required. Authorization to process data for commercial purposes must clearly identify that purpose and allow verifiable proof to be retained. Where feasible, a separate, unchecked choice for promotional communications shall be requested, without making it a condition of contracting a service when it is not necessary to provide that service.

Nérdico may process data that are genuinely public within the limits of the law. However, the fact that information about a natural person appears on the internet, in a directory, on a professional network, or on a business website does not, by itself, authorize any reuse or indiscriminate campaign. Before adding it to a prospecting database, the source, the public nature of the data, the purpose, the necessity, and the condition permitting commercial use shall be documented. Where the law or applicable interpretation requires Authorization for direct marketing, it must be obtained before the communication is sent.

Purely corporate contact details of a legal entity may be treated differently from personal data relating to a natural person. If an email address, telephone number, or other data can identify or contact a natural person, its nature and applicable framework shall be assessed; it shall not be assumed that a business domain means the data are no longer personal data.

For SMS, messaging through applications or the web, email, and telephone calls of a commercial or advertising nature, Nérdico shall comply with the applicable rules under Law 2300 of 2023, the regulations governing the Registry of Excluded Numbers (RNE), and other provisions in force. Before contacting anyone, Nérdico shall verify, as applicable, that the channel may be used, that the recipient has not exercised an applicable exclusion, and that the contact occurs within the legally permitted hours. As a conservative operational rule, campaigns shall not be sent on Sundays or public holidays, and the hours provided in Article 3 of Law 2300 of 2023 shall be observed to the extent they apply to commercial contact.

Every commercial message must reasonably identify Nérdico, have a legitimate purpose, and offer a simple, accessible, and effective way to stop receiving future communications through that channel. Requests to object, withdraw, revoke, or opt out shall be recorded and implemented without undue delay in the relevant systems and lists. An alternative channel shall not be used to circumvent the Data Subject's decision not to receive communications.

Authorization to process data and the ability to contact someone through a particular channel are related but distinct controls: having contact details or general Authorization does not remove the obligation to verify channel restrictions, purpose, exclusions, and applicable rules.

8.5. Analytics and improvement

Data may be processed to:

• improve processes;
• measure performance;
• analyze service usage;
• identify recurring problems;
• improve products and services;
• generate statistics;
• develop operational learnings.

Where possible, aggregated, anonymized, or pseudonymized data shall be preferred.

8.6. Security and traceability

Data may be used to:

• control access;
• investigate incidents;
• maintain traceability;
• protect systems;
• detect improper use;
• preserve evidence necessary to defend rights.

9. Categories of Data Subjects

Depending on its activities, Nérdico may process data relating to:

• prospects;
• customers;
• users;
• legal representatives;
• administrators;
• employees and collaborators;
• contractors;
• candidates;
• suppliers;
• partners;
• business contacts;
• people who submit inquiries, complaints, or requests;
• people whose data Nérdico processes on behalf of a customer.

Not all these categories will be present in every database.

10. Categories of data processed

Nérdico may process, where relevant to a specific purpose:

• identification data;
• contact details;
• employment or professional information;
• business information associated with a natural person;
• contractual information;
• commercial information;
• billing and accounts receivable information;
• service usage information;
• technical information necessary to provide or secure a service;
• information contained in requests, tickets, and communications;
• access and security logs;
• information necessary to carry out projects.

Nérdico shall apply the minimization principle and avoid collecting information that is not relevant to the purpose.

11. Sensitive Data

Nérdico shall avoid collecting or processing Sensitive Data unless there is a legitimate need and a condition for Processing permitted by law.

When it is necessary to process Sensitive Data:

• the Data Subject shall be informed of its sensitive nature;
• the Data Subject shall be informed when providing an answer is optional;
• explicit Authorization shall be requested when legally necessary;
• access shall be restricted;
• enhanced security controls shall be applied;
• the purpose and justification for Processing shall be documented.

Sensitive Data shall not be requested for convenience through forms, WhatsApp, email, CRM, Helpdesk, or AI tools.

12. Children and adolescents

Nérdico shall avoid processing the personal data of children and adolescents when such data are not necessary for its activities.

When a service requires processing information about minors, the process must be specifically assessed before implementation and must respect the child's best interests, fundamental rights, and applicable legal rules.

Data relating to minors shall not be added to systems, campaigns, automations, or AI tools merely for convenience.

13. Data Subject Authorization

Where the law requires Authorization, Nérdico must obtain it before or no later than the time of collection, through a mechanism that allows subsequent proof to be retained. The record must make it possible to demonstrate who gave Authorization, when, by what means, which text or version was accepted, and which purposes and channels were included.

Authorization must be prior, express, and informed, and must be given through unequivocal conduct. It shall not be inferred from silence, failure to respond, the mere existence of contact details, or continuation of a relationship that does not require such consent.

Before requesting Authorization, Nérdico shall disclose, as applicable:

• the Processing;
• the specific purposes;
• the Data Subject's rights;
• the identity and contact details of the Data Controller;
• that questions about Sensitive Data or children and adolescents are optional;
• the commercial channels the Data Subject may choose or exclude, where applicable;
• the mechanism for withdrawing Authorization or ceasing to receive commercial communications.

For commercial purposes, Nérdico must distinguish handling a request initiated or made by the Data Subject—such as responding to a quotation request—from subsequent promotional campaigns. A request for information may justify responding to that request in context, but it shall not automatically be interpreted as general, indefinite, or multi-channel Authorization for future campaigns.

Nérdico shall retain proof of Authorizations obtained where applicable and maintain a record of revocations, objections, exclusions, and contact preferences.

Authorization shall not be required in cases where the law expressly permits Processing without it. However, an exception to the Authorization requirement does not eliminate the other obligations under the data protection framework or the specific rules governing commercial communications.

14. Data obtained from publicly accessible sources

Nérdico may process data that are public in nature within the limits established by law and only where the data are genuinely public by nature, not merely because they are visible or accessible on the internet.

The fact that information appears on a website, social network, directory, commercial platform, or accessible document does not automatically make all the data public or authorize any purpose, reuse, profiling, or communication. Private, semi-private, or Sensitive Data do not become public data merely because they have been published or obtained by a third party.

Before incorporating information into commercial processes, CRM systems, automations, or campaigns, Nérdico must verify and record the source, nature of the data, context in which it was published, known original purpose, relevance, proportionality, legal condition for Processing, and channel rules. If it cannot reasonably establish that the data are public or that a valid condition exists for the proposed commercial use, the data shall not be added to the prospecting database or used for advertising contact until the applicable authorization is clarified.

Publicly accessible sources shall not be used as a way to circumvent Authorization where it is required for direct marketing.

15. Processing customer data

When Nérdico processes a customer's personal data as part of providing a service:

1. the purpose of access shall be identified;
2. Nérdico's role as Data Controller or Data Processor shall be determined;
3. access shall be limited to the information needed;
4. unnecessary copies shall be avoided;
5. customer data shall not be reused for Nérdico's own purposes that are incompatible with those authorized;
6. confidentiality shall be maintained;
7. relevant instructions shall be documented;
8. rules for return, deletion, retention, and backups shall be established where applicable;
9. third parties that may participate in Processing shall be identified;
10. incidents shall be managed in accordance with the contract and the law.

16. Suppliers, partners, and third parties

Before engaging a third party that processes personal data, Nérdico shall assess, according to the risk:

• what data it will receive;
• for what purpose;
• in what role it will act;
• where the data will be processed;
• for how long;
• who will have access;
• which subcontractors are involved;
• what security measures it offers;
• how incidents are managed;
• what deletion or return mechanisms exist;
• what contractual terms apply;
• whether international transfers or transmissions occur.

When Nérdico acts as Data Controller and a third party acts as Data Processor, the Processing terms shall, where necessary, be formalized by contract or an equivalent instrument.

17. International transfers and transmissions

Nérdico may use technology providers located outside Colombia, including providers of storage, communications, CRM, automation, analytics, or artificial intelligence services.

The use of a foreign provider must be legally assessed to determine whether it involves:

• an international transfer to another Data Controller; or
• an international transmission to a Data Processor that processes data on Nérdico's behalf.

International transfers must comply with the rules of Law 1581 of 2012 and the applicable provisions concerning countries with an adequate level of protection and exceptions.

International transmissions between a Data Controller and a Data Processor may be carried out in accordance with the applicable legal rules and required contractual terms.

Nérdico shall not send personal data to a foreign third party solely for technical convenience without first assessing the operation.

18. Artificial intelligence

Given Nérdico's technological nature, Processing through artificial intelligence systems is an area requiring special controls.

As an institutional rule:

Access to data does not mean authorization to enter it into any AI tool.

Before using real personal data in an AI tool, the following shall be assessed, as applicable:

• purpose;
• necessity;
• type of data;
• Nérdico's legal role;
• provider;
• location of Processing;
• international transmission or transfer;
• secondary use of the data;
• retention;
• privacy settings;
• security;
• access controls;
• contractual terms;
• possibility of anonymization or pseudonymization.

Where possible, preference shall be given to data that are:

• anonymized;
• fictitious;
• aggregated;
• minimal;
• stripped of unnecessary identifiers.

When Nérdico acts as a Data Processor, it shall not use customer data to train, improve, or develop its own AI systems unless there is sufficient Authorization, instruction, or legal basis to do so.

19. CRM, Helpdesk, and automations

Nérdico's commercial and operational systems must incorporate data protection by design.

At a minimum, they should include, where technically feasible:

• role-based access control;
• least privilege;
• identification of the source of information;
• traceability;
• management of Data Subject requests;
• updating and rectification;
• deletion where applicable;
• integration controls;
• third-party management;
• reduction of duplicates;
• retention according to defined criteria;
• backup protection;
• recording the commercial purpose, source, and evidence of Authorization where applicable;
• recording preferred/permitted channels and contact exclusions;
• a suppression list or equivalent mechanism to prevent accidental reactivation of contacts who requested not to receive advertising.

Automations must not turn personal data into authorization to take any action. Every campaign must check the applicable conditions of use, preferences, and exclusions before it is executed.

20. Website and forms

Nérdico's forms, landing pages, and digital channels must collect only the information necessary for the disclosed purpose.

When a form is intended to generate prospects or build a marketing database, this must be stated visibly before collecting the data, and it must explain that Nérdico may contact the Data Subject for commercial purposes. Where applicable, the mechanism must distinguish the user's specific request from acceptance of future promotional communications and identify the authorized channels or preferences collected. The commercial acceptance checkbox must not be preselected; access to the service or requested response shall not be conditional on accepting future advertising when such advertising is not necessary for that handling.

Before putting a form into production, the following must be verified, as applicable:

• privacy notice;
• Processing Policy;
• Authorization mechanism and evidence;
• specific purposes and channels;
• requested fields;
• processing of Sensitive Data;
• third-party tools;
• cookies and similar technologies;
• analytics;
• storage;
• transfers or transmissions;
• channel for exercising rights;
• simple mechanism for withdrawing commercial Authorization or ceasing to receive messages.

The Processing Policy must remain available for consultation.

21. Cookies and tracking technologies

When the website uses cookies, pixels, analytics tools, behavioral advertising, or other technologies involving personal data, Nérdico must determine the applicable information, consent, and configuration requirements.

The technical implementation must correspond to the published legal texts.

When a third-party tool collects information, its purpose and Processing must be assessed in advance.

22. Data retention

Nérdico shall not retain personal data indefinitely merely for convenience.

Retention shall depend on:

• purpose;
• duration of the relationship;
• legal obligations;
• contractual obligations;
• needs relating to the defense of rights;
• requests from authorities;
• backups;
• Nérdico's role as Data Controller or Data Processor.

Specific periods must be documented in a Data Retention and Deletion Matrix.

While that matrix is being completed, teams must not establish arbitrary retention periods or delete information where there is a legal, contractual, or evidentiary obligation to retain it.

23. Suppression and deletion

When the purpose ends and no legal, contractual, or evidentiary obligation justifies retention, Nérdico must assess suppression, anonymization, or secure deletion.

Deletion must take into account:

• primary databases;
• files;
• copies;
• backups;
• third-party systems;
• devices;
• documentation;
• information processed by Data Processors.

When Nérdico acts as a Data Processor, return or deletion must follow the Data Controller's instructions and the applicable contractual terms.

24. Data Subjects' rights

Data Subjects may exercise, in accordance with the law, the right to:

1. know, update, and rectify their data;
2. request proof of Authorization, where it is required;
3. request information about how their data have been used;
4. file complaints with the Superintendence of Industry and Commerce after completing the corresponding prior procedure;
5. request revocation of Authorization and/or deletion where legally applicable;
6. access their personal data free of charge under the terms established by law.

These rights shall also be exercised subject to the exceptions and limitations established by applicable legislation.

25. Procedure for inquiries and complaints

Data Subjects may submit inquiries, complaints, requests to update or correct data, deletion requests, or revocation requests through info@nerdico.co or WhatsApp +57 320 526 6808. These are the published official channels for this purpose; no dedicated web form is currently available. Nérdico must record the receipt date, channel, request type, person responsible for handling it, and applicable statutory deadline; acknowledge receipt where reasonable; and verify identity proportionately without requesting unnecessary data or documents.

25.1. At a minimum, the request must allow Nérdico to

• identify the Data Subject;
• identify the right they wish to exercise;
• describe the request;
• provide information that makes it possible to locate the data;
• provide a physical or electronic address, or another contact method for receiving a response;
• provide documents where necessary.

Where a representative acts on the Data Subject's behalf, Nérdico may request the supporting documents needed to verify the representation.

25.2. Inquiries

Inquiries shall be handled within the applicable maximum statutory period.

Under the general framework of Law 1581 of 2012, the period is ten (10) business days from receipt. If it is not possible to respond within that period, the reasons and response date shall be communicated; the response date may not exceed the five (5) business days following the end of the initial period. (Law 1581 of 2012, Articles 14 and 15).

25.3. Complaints

Complaints shall be handled in accordance with the legal procedure.

If a complaint is incomplete, the requester must be asked to correct the deficiencies within five (5) days of receipt. If the requester does not provide the information within two (2) months after the request, the complaint is deemed withdrawn, as provided in Article 15 of Law 1581 of 2012.

Once a complete complaint has been received, the database must be marked "complaint under review" and the reason recorded within no more than two (2) business days; the notice must remain until the complaint is decided, as required by Article 15 of Law 1581 of 2012.

The general maximum period for resolving a complaint is fifteen (15) business days counted from the day after receipt, with the possibility of an extension of up to eight (8) business days when the reason and new response date are communicated in a timely manner. (Law 1581 of 2012, Article 15).

25.4. Referral

If Nérdico receives a complaint it is not competent to resolve, it must refer it to the appropriate party within a maximum of two (2) business days and inform the requester, as required by Article 15 of Law 1581 of 2012.

25.5. No charge

The exercise of rights shall be free of charge under the conditions established by the applicable regulations.

26. Revocation and deletion

The Data Subject may request revocation of Authorization and/or deletion of their data where legally applicable.

Such requests shall not be granted where there is a legal or contractual duty to keep the data in the database or another legal condition justifying retention.

Nérdico shall provide easily accessible mechanisms for submitting these requests.

27. Information security

Nérdico shall apply reasonable measures proportionate to the risk, taking into account the nature of the data and the operations performed.

Controls may include:

• strong passwords;
• multi-factor authentication where appropriate;
• least privilege;
• permission controls;
• access reviews;
• software updates;
• device protection;
• backups;
• encryption where appropriate;
• logs and traceability;
• separation of personal and corporate accounts;
• revocation of access when a relationship ends;
• supplier management;
• incident response procedures.

Security shall not be limited to technical tools; it shall also include human, administrative, and contractual controls.

28. Credentials, secrets, and access data

Passwords, tokens, API keys, private keys, recovery codes, and other secrets:

• are not part of ordinary institutional memory;
• must not be stored in this Policy;
• must not be included in public documentation;
• must not be sent through insecure channels when a reasonable alternative exists;
• must be protected using appropriate mechanisms;
• must be revoked or rotated when exposure is suspected.

29. Security incidents

Nérdico must have an internal procedure for managing incidents that may compromise personal data.

Depending on the case, the procedure must include:

1. detection;
2. containment;
3. assessment;
4. identification of scope;
5. documentation;
6. preservation of evidence;
7. internal communication;
8. assessment of notification obligations;
9. communication to customers or Data Subjects where applicable;
10. recovery;
11. corrective actions;
12. prevention of recurrence.

When Nérdico acts as a Data Processor, it must inform the Data Controller in accordance with the contract and within the time needed for the Data Controller to meet its legal obligations.

30. Confidentiality

Anyone involved in Processing non-public personal data must maintain the required confidentiality.

This obligation extends, as applicable, to:

• collaborators;
• contractors;
• AI agents;
• suppliers;
• partners;
• Data Processors;
• authorized subcontractors.

Access to information must be linked to a legitimate need and the assigned role.

31. Demonstrable accountability

Nérdico shall adopt an approach based on demonstrable accountability: it is not enough to state that data are protected; Nérdico must seek to maintain evidence that its measures and procedures are implemented.

Compliance documentation may include:

• Policy;
• notices;
• Authorizations;
• contracts;
• processing matrix;
• Data Controller/Data Processor matrix;
• supplier inventory;
• request records;
• incident records;
• training evidence;
• access controls;
• tool assessments;
• decision records;
• periodic reviews.

32. Processing Register

Nérdico must create and maintain a Processing Register that identifies, at a minimum:

• process;
• database or system;
• category of Data Subjects;
• categories of data;
• purpose;
• Nérdico's role;
• source;
• Authorization or legal condition;
• authorized users;
• Data Processors;
• suppliers;
• transfers or transmissions;
• location of Processing;
• security measures;
• retention;
• deletion;
• risks;
• internal process owner.

The register must evolve along with the business.

33. National Database Registry (RNBD)

Nérdico must determine and document whether it falls within the categories of entities required to register databases in the RNBD, according to its legal and economic characteristics and the rules in force.

The obligation shall neither be presumed nor ruled out solely on the basis of Nérdico's commercial size.

The SIC administers the RNBD as a public directory of databases subject to Processing, and the applicable framework is set out in Chapter 26 of Decree 1074 of 2015 and related rules. For official information, see the SIC National Database Registry.

34. Management of technology third parties

Before integrating a new tool that processes personal data, Nérdico must assess, according to the risk:

• provider;
• legal role;
• data involved;
• purposes;
• location;
• transfer or transmission;
• retention;
• deletion;
• security;
• subproviders;
• secondary use;
• contractual terms.

This applies particularly to:

• CRM;
• Helpdesk;
• email;
• messaging;
• storage;
• analytics;
• automation;
• web platforms;
• AI tools;
• infrastructure providers.

35. Privacy by design

Data protection must be incorporated from the design stage of new processes and systems.

Before implementing a new solution that processes personal data, the following questions must be asked:

1. What data does it need?
2. What is the purpose?
3. What is Nérdico's legal role?
4. What condition permits the Processing?
5. Which Data Subjects are involved?
6. Who will have access?
7. Which third parties will be involved?
8. Will there be international Processing?
9. How long will the data be retained?
10. How will the data be deleted?
11. What risks exist?
12. Can the amount of information be reduced?

36. Processing prospect information

Nérdico's commercial methodology contemplates information such as:

• company;
• sector;
• location;
• contact;
• role;
• source;
• opportunity signal;
• potential need;
• potential service;
• priority;
• commercial status;
• last contact;
• next action;
• notes.

These data must be managed in compliance with purpose limitation, minimization, transparency, and the applicable legal conditions. The CRM shall also record the source of the contact, the date obtained, the permitted purpose, evidence or a reference to Authorization where applicable, permitted channels, preferences, the last interaction, do-not-contact requests, and the date or criterion for review/deletion.

Nérdico may use commercial data relating to a legal entity for B2B relationships within reasonable limits. If the data identify a natural person (for example, a name, named email address, personal mobile number, or data relating to a sole proprietor), the relevant personal data assessment shall apply. Personal data shall not be purchased, extracted in bulk, or enriched for campaigns without first verifying their source, purpose, and conditions of use. The existence of a business account does not cure unlawful collection of personal data.

Before uploading a list obtained from third parties, importing a database into the CRM, or activating an automated campaign, its source, evidence that commercial use is permitted, exclusion status, and use/transfer restrictions must be verified. If sufficient evidence is missing, the list shall be quarantined and may not be activated for advertising until the issue is resolved.

Commercial information must not automatically become available to all agents, collaborators, or suppliers.

37. Use by AI agents and collaborators

Nérdico's agents and collaborators must follow this principle:

Technical access does not equal legal authorization.

Before using personal information, they must know:

• the purpose;
• their role;
• their access level;
• the restrictions;
• the confidentiality requirements;
• the limits on sharing or reusing information.

Agents must not:

• invent Authorizations;
• assume that data may be used for any purpose;
• share personal data unnecessarily;
• enter Sensitive Data into unauthorized tools;
• use customer information for their own purposes without authorization;
• retain information indefinitely;
• initiate prospecting campaigns using databases whose source and authorization have not been verified;
• ignore exclusions, objections, revocations, or do-not-contact requests;
• assume that general Authorization permits any channel, frequency, or commercial content.

Agents may classify prospects, prepare drafts, and propose contacts in accordance with the commercial workflow, but campaigns must be executed in accordance with validated rules, evidence, permitted channels, applicable hours, and exclusion controls. Agents may not invent or record an Authorization that does not exist.

38. Publication and availability of the Policy

This Policy must be available to Data Subjects in physical or electronic form, using clear and simple language.

The public version must include the Data Controller's full identification and contact details and the official channel for exercising rights.

When substantial changes are made, Nérdico must communicate them effectively and with the advance notice required by the applicable regulations.

39. Effective date

This version 1.1 enters into force on the date of its formal approval by the Data Controller. No retroactive effects are attributed to this version.

Date of formal approval and entry into force of version 1.1: October 12, 2026.

The Policy shall remain in force for as long as the Processing to which it applies continues. Databases shall remain in force for the period during which the purposes of Processing in each database continue, or for the period applicable due to a specific legal, contractual, or judicial reason, without prejudice to applicable updates and retention obligations.

The Policy shall be reviewed at least whenever:

• legislation changes;
• SIC instructions change;
• services change substantially;
• new systems are introduced;
• new relevant suppliers are added;
• new AI processing activities are introduced;
• purposes change;
• a relevant incident occurs;
• a significant legal risk is identified.

Official legal references

• Law 1581 of 2012 — Legal Information System of the Administrative Department of the Public Service (Función Pública): https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=49981

• Decree 1377 of 2013 — Legal Information System of the Administrative Department of the Public Service (Función Pública): https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=53646

• National Database Registry — Superintendence of Industry and Commerce: https://www.sic.gov.co/registro-nacional-de-bases-de-datos

• Decree 255 of 2022 — SUIN Juriscol: https://www.suin-juriscol.gov.co/viewDocument.asp?id=30043921

• Law 2300 of 2023 — Legal Information System of the Administrative Department of the Public Service (Función Pública): https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=213990

• Registry of Excluded Numbers (RNE) — Communications Regulation Commission: https://www.crcom.gov.co/es/micrositios/comunicados-como-es/registro-numeros-excluidos

• SIC — Scope of application of Law 1581 of 2012 with respect to corporate data: https://sedeelectronica.sic.gov.co/boletin-juridico/conceptos/ambito-de-aplicacion-de-la-ley-1581-de-2012-en-datos-corporativos