Kadree Tech

Terms and Conditions

GENERAL PERSONAL DATA PROCESSING AND PROTECTION POLICY KADREE TECH S.A.S.

1. PURPOSE AND SCOPE

In compliance with Article 15 of the Political Constitution of Colombia, Statutory Law 1581 of 2012, Regulatory Decree 1377 of 2013, as incorporated into Single Regulatory Decree 1074 of 2015, as well as the applicable case law and guidelines issued by the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio – SIC), KADREE TECH S.A.S. hereby adopts this Personal Data Processing and Protection Policy (hereinafter, the “Policy”).

This Policy applies to all personal data and information recorded in the Company’s databases for which KADREE TECH S.A.S. acts as the Data Controller and/or Data Processor. The scope of this Policy covers all customers, users, prospects, business partners, suppliers, contractors, employees, former employees, and any natural person whose information is collected, stored, used, disclosed, transmitted, transferred, or deleted by the Company within the territory of the Republic of Colombia or outside Colombia whenever Colombian law is applicable.

2. IDENTIFICATION OF THE DATA CONTROLLER

  • Legal Name: KADREE TECH S.A.S.
  • Tax Identification Number (NIT): 900699822-2
  • Registered Office and Principal Address: Calle 93B # 13-91, Office 600, Bogotá D.C., Colombia
  • Contact Telephone: +57 300 8013539
  • Habeas Data Contact Email: info@kadreetech.com
  • Website: https://kadreetech.com

3. LEGAL DEFINITIONS AND GOVERNING PRINCIPLES

For purposes of this Policy, the following definitions shall apply:

  • Authorization: The Data Subject’s prior, express, and informed consent to the Processing of personal data.
  • Privacy Notice: A verbal or written communication issued by the Data Controller and addressed to the Data Subject regarding the Processing of their personal data, informing them of the existence of the applicable information Processing policies, how to access such policies, and the purposes for which their personal data will be Processed.
  • Database: An organized set of personal data subject to Processing.
  • Personal Data: Any information linked or capable of being associated with one or more identified or identifiable natural persons.
  • Public Data: Data that is not classified as semi-private, private, or sensitive. Public data includes, among other information, data relating to an individual’s civil status, profession or occupation, and status as a merchant or public servant.
  • Sensitive Data: Data affecting the Data Subject’s privacy or whose improper use may result in discrimination, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, membership in trade unions, social organizations or human rights organizations, as well as information relating to health, sexual life, and biometric data, including image capture, fingerprints, facial recognition, and similar information.
  • Data Relating to Children and Adolescents: Information concerning minors, the Processing of which is subject to special and enhanced protection.
  • Data Processor: A natural or legal person, public or private, who, independently or jointly with others, Processes personal data on behalf of the Data Controller.
  • Data Controller: A natural or legal person, public or private, who, independently or jointly with others, makes decisions regarding a database and/or the Processing of personal data.
  • Data Subject: The natural person whose personal data is subject to Processing.
  • Transfer: A transfer of data occurs when a Data Controller and/or Data Processor located in Colombia sends personal information or personal data to a recipient who is also a Data Controller and is located either within or outside Colombia.
  • Transmission: The Processing of personal data involving the communication of such data within or outside the territory of the Republic of Colombia for the purpose of Processing by a Data Processor on behalf of the Data Controller.

Governing Principles: Personal data Processing shall be strictly governed by the principles of legality, purpose limitation, freedom, truthfulness or quality, transparency, restricted access and circulation, security, and confidentiality, as required under Article 4 of Law 1581 of 2012.

4. PROCESSING OF SENSITIVE DATA AND DATA RELATING TO MINORS

4.1. Sensitive Data

KADREE TECH S.A.S. informs Data Subjects that they are not required to authorize the Processing of Sensitive Data.

The Company shall collect this type of data only when strictly necessary, including for purposes such as biometric access control to Company facilities, lawful management of occupational health information within the Occupational Health and Safety Management System (SG-SST) for employees, or compliance with court orders.

Whenever Sensitive Data is requested, the Company shall clearly and expressly identify which information is considered sensitive and explain the purpose for which such information is being collected.

4.2. Data Relating to Children and Adolescents

The Processing of personal data relating to minors shall be exceptional.

Data concerning children and adolescents shall only be Processed when such data is public in nature, when Processing is strictly necessary to enroll employees’ beneficiaries in the social security system or family compensation funds, or when necessary to provide a service expressly requested by a parent or legal guardian.

In all cases, the Company shall protect the best interests of the minor, ensure respect for their fundamental rights, and obtain express authorization from their legal representative—parent, mother, father, or guardian—after allowing the minor to exercise their right to be heard in a manner appropriate to their level of maturity.

5. PURPOSES OF PERSONAL DATA PROCESSING

Personal data collected by KADREE TECH S.A.S. shall be used for the following purposes, according to the relevant group of Data Subjects:

5.1. Customers, Prospects, Website Visitors, and Users of Technology Platforms

  • To provide the technology products and services offered by the Company, perform contractual obligations, provide technical support and maintenance, and conduct service follow-up activities.
  • To process payments, billing, collections, and related financial, accounting, and administrative activities.
  • To send informational, advertising, commercial, and marketing communications, invitations to events, promotions, and newsletters through physical or electronic means, including email, SMS, WhatsApp, and telephone calls.
  • To conduct market research, data analytics, consumer behavior statistics, customer satisfaction surveys, and service quality evaluations.
  • To control physical access to corporate facilities and ensure security through video surveillance systems (CCTV).
  • To carry out national and international data transmissions and transfers to technology service providers, including cloud computing providers, CRM platforms, analytics providers, and other strategic partners, while ensuring compliance with legally required security standards.

5.2. Suppliers and Contractors

  • To register, assess, and select suppliers and contractors within the Company’s systems.
  • To verify commercial, judicial, tax, and disciplinary records, as well as restricted-party lists, for purposes related to the prevention of money laundering and terrorist financing under applicable SARLAFT and SAGRILAFT requirements.
  • To process purchase orders, professional fee payments, invoices, and compliance with accounting and tax obligations.

5.3. Employees, Job Applicants, and Former Employees

  • To carry out recruitment and selection processes, interviews, psychometric assessments, pre-employment examinations, and reference checks.
  • To execute, administer, terminate, and settle employment agreements; process payroll; and make contributions to the Comprehensive Social Security System and applicable payroll-related contributions.
  • To implement training programs, professional development activities, performance evaluations, promotions, and employee wellness initiatives.
  • To manage the Occupational Health and Safety Management System (SG-SST), including the recording of workplace accidents, epidemiological reporting, and periodic or occupational medical examinations.
  • To issue employment certificates for former employees and retain historical employment records for the period required under Colombian labor law.

6. RIGHTS OF DATA SUBJECTS

Pursuant to Law 1581 of 2012, Data Subjects have the right to:

  1. Access, update, and rectify their personal data before KADREE TECH S.A.S. in its capacity as Data Controller or Data Processor. This right may be exercised with respect to partial, inaccurate, incomplete, fragmented, or misleading information, as well as data whose Processing is expressly prohibited or has not been authorized.
  2. Request evidence of the authorization granted to the Company for the Processing of personal data, except in the circumstances exempted under Article 10 of Law 1581 of 2012.
  3. Be informed, upon request, of the manner in which KADREE TECH S.A.S. has used their personal data.
  4. File complaints with the Superintendence of Industry and Commerce (SIC) regarding violations of applicable data protection laws, after first exhausting the consultation or complaint procedure directly with the Company.
  5. Withdraw authorization and/or request the deletion of personal data when the Processing fails to comply with applicable constitutional and legal principles, rights, and guarantees. Deletion or withdrawal of authorization shall not apply where the Data Subject has a legal or contractual obligation to remain in the Company’s database, including, for example, obligations arising from tax, accounting, or employment requirements or an ongoing contractual relationship.
  6. Access their personal data free of charge at least once per calendar month or whenever substantial amendments are made to this Policy.

7. OBLIGATIONS OF KADREE TECH S.A.S. AS DATA CONTROLLER

KADREE TECH S.A.S. undertakes to comply with the following legal obligations:

  1. Guarantee Data Subjects, at all times, the full and effective exercise of their habeas data rights.
  2. Request and retain evidence of the corresponding authorization granted by the Data Subject.
  3. Properly inform Data Subjects of the purpose for which their information is being collected and of the rights available to them by virtue of the authorization granted.
  4. Store information under appropriate technical, human, and administrative security measures necessary to prevent alteration, loss, unauthorized or fraudulent access, consultation, or use.
  5. Ensure that information provided to Data Processors is truthful, complete, accurate, up to date, verifiable, and understandable.
  6. Keep information updated and promptly communicate to Data Processors any changes concerning previously provided data.
  7. Correct inaccurate information and communicate the corresponding corrections to the Data Processor.
  8. Handle consultations and complaints in accordance with the timeframes and procedures established under Law 1581 of 2012.
  9. Notify the competent data protection authority—the Superintendence of Industry and Commerce—when security breaches occur and such incidents pose risks in connection with the management of Data Subjects’ personal information.
  10. Adopt internal policies, manuals, and procedures to ensure compliance with the principle of demonstrated accountability.

8. PROCEDURE FOR HANDLING HABEAS DATA CONSULTATIONS AND COMPLAINTS

Data Subjects, their successors, duly authorized representatives, or attorneys-in-fact may exercise their habeas data rights by submitting a formal request to info@kadreetech.com or by filing a written request at the following address:

Calle 93B # 13-91, Office 600, Bogotá D.C., Colombia.

The following procedures and statutory deadlines shall apply:

8.1. Consultations

Access to Information and Data History

  • Consultation requests shall be answered within a maximum period of ten (10) business days from the date the request is received.
  • If the consultation cannot be answered within such period, the Company shall inform the interested party of the reasons for the delay and provide the date on which the consultation will be answered. Such additional period shall under no circumstances exceed five (5) business days following the expiration of the initial term.

8.2. Complaints

Updates, Rectification, Deletion, and Withdrawal of Authorization

A Data Subject or their successors who believe that information contained in a database should be corrected, updated, or deleted, or who become aware of an alleged breach of any applicable obligation, may submit a complaint to KADREE TECH S.A.S. The complaint shall be handled as follows:

  1. The complaint shall be submitted through a request containing, at a minimum, the identification of the Data Subject, a description of the facts giving rise to the complaint, an address for notifications, and any supporting documents the claimant wishes to submit as evidence.
  2. If the complaint is incomplete, the interested party shall be requested, within five (5) business days following receipt of the complaint, to remedy the deficiencies. If two (2) months elapse from the date of such request without the applicant providing the required information, the complaint shall be deemed withdrawn.
  3. Once a complete complaint has been received, the Company shall add a notation to the relevant database stating “complaint pending”, together with the reason for the complaint, within no more than two (2) business days. Such notation shall remain in place until the complaint has been resolved.
  4. The maximum period for resolving a complaint shall be fifteen (15) business days, calculated from the business day following the date on which the complaint was received.
  5. If the complaint cannot be resolved within such period, the Company shall inform the interested party of the reasons for the delay and the date on which the complaint will be resolved. Such additional period shall under no circumstances exceed eight (8) business days following the expiration of the initial term.

9. TRANSFER AND TRANSMISSION OF PERSONAL DATA

9.1. International Transfers

KADREE TECH S.A.S. shall not transfer personal data to third countries that do not provide adequate levels of data protection as recognized by the Superintendence of Industry and Commerce, unless:

  • the Data Subject has provided prior, express, and informed authorization;
  • a statutory exception applies, such as a medical emergency; or
  • the corresponding data transfer agreements have been entered into, ensuring appropriate safeguards for the Data Subject’s rights.

9.2. National and International Data Transmission

The Company may disclose or transmit personal data to third-party Data Processors located in Colombia or abroad for the provision of services related to the Company’s business activities, including cloud hosting services, accounting software, and marketing agencies.

In all cases, a Personal Data Transmission Agreement shall be entered into under which the Data Processor agrees to strictly comply with this Policy, maintain professional confidentiality, implement appropriate safeguards, and refrain from using personal data for purposes other than those for which its services were engaged.

10. EFFECTIVE DATE OF THIS POLICY AND RETENTION OF DATABASES

This updated Personal Data Processing and Protection Policy of KADREE TECH S.A.S. shall become effective as of the date of its official publication.

The Company shall retain information contained in its databases for as long as is legally or contractually reasonable and necessary to fulfill the purposes for which the personal data was originally collected, subject to any statutory accounting, tax, labor, or document-retention obligations requiring a longer retention period.

Once the applicable purpose has been fulfilled, or when deletion is lawfully requested by the Data Subject, the Company shall proceed with the secure deletion or permanent anonymization of the information.