Privacy and Personal Data Processing Policy

01 Data controller

The controller of your personal data (responsable del tratamiento) is:

• Legal name: Klydo S.A.S.
• NIT: 000000002-5
• Registered address: Calle 93B # 13 - 91 Oficina 600 Edificio Meridiano 93, Bogotá, Bogotá, Colombia
• Email: contact@klydo.com.co
• Phone: +57 312 868 7873
• Website: https://www.klydo.com.co

02 Legal framework and definitions

This policy is governed by the Political Constitution of Colombia (Constitución Política de Colombia, article 15), Statutory Law 1581 of 2012 (Ley Estatutaria 1581 de 2012), Decree 1377 of 2013 (Decreto 1377 de 2013, compiled in Single Regulatory Decree 1074 of 2015, Decreto Único Reglamentario 1074 de 2015) and the other rules that amend or supplement them.

For the purposes of this policy, the following definitions apply:

• Data subject (Titular): the natural person whose personal data is processed.
• Personal data (Dato personal): any information linked to, or that can be associated with, an identified or identifiable natural person.
• Processing (Tratamiento): any operation on personal data, such as its collection, storage, use, circulation or deletion.
• Data controller (Responsable del tratamiento): whoever decides on the database and the processing of the data.
• Data processor (Encargado del tratamiento): whoever processes the data on behalf of the controller.
• Authorization (Autorización): the prior, express and informed consent of the data subject to carry out the processing.

03 Data we collect

We only collect the data you voluntarily give us through the contact form or by email:

• Name.
• Company.
• Email address.
• Phone number, if you choose to share it.
• The service you are interested in.
• The estimated budget, if you choose to indicate it.
• The description of your project or need, along with any details you want to include.
• Proof of your authorization: the date and time you granted it, the version of this policy and the text you accepted.

We do not request sensitive data or data about children or adolescents. We ask you not to include this type of information in your messages.

In addition, only if you authorize it in the cookie banner, we process the browsing data described in the analytics section of this policy.

If you book the free diagnostic online, we also process the data you provide when booking, which is described in the online booking section of this policy.

04 Purposes of processing

We use your personal data exclusively for the following purposes:

1. Responding to the business requests and inquiries you send us through the contact form.
2. Scheduling and holding diagnostic meetings about your project.
3. Preparing and sending you technical and commercial proposals, quotes and related documents.
4. Following up on ongoing conversations and proposals.
5. Complying with legal obligations and responding to requests from competent authorities.
6. Measuring visits to this site and improving its content, only if you authorize it in the cookie banner.

We do not sell, rent or transfer your personal data to third parties for commercial purposes, and we do not use it for purposes other than those described here without asking you for a new authorization.

05 Rights of the data subject

As the data subject of the personal data, you have the right to:

• Know (conocer) the personal data we hold about you and how we have used it.
• Update and rectify (actualizar y rectificar) your data when it is partial, inaccurate, incomplete or erroneous.
• Request proof (solicitar prueba) of the authorization you granted us.
• Delete (suprimir) your data and revoke the authorization (revocar la autorización) when the legal principles, rights and guarantees are not respected, provided there is no legal or contractual duty to keep it.
• File complaints with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio, SIC) for violations of the data protection rules, once the inquiry or claim procedure with us has been exhausted.
• Access free of charge (acceder gratuitamente) the personal data being processed.

06 Authorization

By submitting the contact form or writing to us by email, you grant us your prior, express and informed authorization to process your data in accordance with this policy. With each form submission we record the date and time of your authorization, the version of this policy in force at that moment and the exact text you accepted. We will keep proof of that authorization for as long as your data is being processed by us.

You may revoke this authorization at any time by writing to the channel indicated in the next section.

If you book the diagnostic online, you grant us your authorization by checking the required box of the booking form, before confirming the appointment.

The authorization for analytics is separate: you grant or deny it in the cookie banner, and denying it does not affect your use of the site or the contact form.

07 Inquiries and claims

You can exercise your rights by writing to contact@klydo.com.co. Please include your full name, your identity document, a description of your request, the contact address for the response and, if applicable, the documents you wish to submit.

Inquiries

We will respond to your inquiry within a maximum of ten (10) business days from the date of receipt. If it is not possible to respond within that period, we will inform you of the reasons for the delay and the date of the response, which will not exceed five (5) business days after the first period expires.

Claims

If you believe your data should be corrected, updated or deleted, or you notice an alleged breach, you may file a claim. We will handle it within a maximum of fifteen (15) business days from the day after its receipt. If it is not possible to handle it within that period, we will inform you of the reasons and the date of the response, which will not exceed eight (8) additional business days.

If the claim is incomplete, we will ask you to complete it within the following five (5) days. If two (2) months pass without you submitting the required information, we will consider that you have withdrawn the claim.

08 Security and retention

We apply reasonable technical, human and administrative measures to protect your data against unauthorized access, loss, alteration or fraudulent use, including encryption in transit and access control to the tools where it is stored.

We keep your data for as long as necessary to fulfill the purposes described and, afterwards, for the period required by the applicable legal or contractual obligations. Once that period has ended, we delete it.

09 Transfer and transmission of data

To operate this site and manage communications, we rely on technology providers that act as data processors. The data processors of this site are:

• Web3Forms, a service of Web3Creative (India, with servers in the United States): receives the contact form and delivers it to us by email.
• Microsoft Azure Static Web Apps, a service of Microsoft Corporation (United States): hosts and delivers this website, and records technical data of each visit, such as the IP address.
• Google Analytics 4, a service of Google LLC (United States): measures visits to the site, only if you authorize it in the cookie banner.
• Cal.com, a service of Cal.com, Inc. (United States): provides the booking calendar you can open on the contact page, receives the data of the online booking of the free diagnostic and manages the appointment.
• Google Calendar and Google Meet, services of Google LLC (United States): record the appointment in our calendar and host the video call meeting.
• Microsoft Outlook, a service of Microsoft Corporation (United States): receives the appointment and its confirmation in the team’s calendar and email.

These providers process the information on servers located outside Colombia, so your data is transmitted to those countries. We also use email services to respond to your requests.

In those cases, we require the providers to offer adequate levels of data protection and to process the information solely to provide us with the service, in accordance with Law 1581 of 2012 and its regulations.

10 Online booking of the diagnostic

If you choose to book the free diagnostic online, you can do it in two ways from the contact page: with the Cal.com calendar shown within that page or with the link that opens the Cal.com site in a new tab. The calendar only loads when you choose “See available times”: before that, the page does not load anything from Cal.com or send it any data. When you load it or open the link, your browser connects to the Cal.com servers, which receive the technical data of the connection, such as your IP address, your browser and the domain of this site. In both cases the booking is managed by Cal.com, which is also governed by its own terms and privacy policy, and the cookies it sets are described in our cookie policy. If you would rather not use it, you can write to us with the contact form. These are the conditions of that processing:

• Data processors (encargados del tratamiento): Cal.com, Inc., in the United States, which receives the booking and manages the appointment; Google LLC, in the United States, which records the appointment in our calendar with Google Calendar and hosts the video call meeting with Google Meet; and Microsoft Corporation, in the United States, which receives the appointment and its confirmation in the team’s calendar and email with Microsoft Outlook.
• Purpose: to schedule, confirm, reschedule or cancel the diagnostic meeting, send you the confirmation with the video call link and hold the meeting.
• Data processed: the technical data of the connection with Cal.com described above, your name, your email, the answers you give to the questions of the booking form and the date and time you choose. During the video call, Google Meet also processes the technical data of the connection and your image and voice if you turn on the camera and microphone.
• Basis for processing: your prior, express and informed authorization, which you grant by checking the required box of the booking form before confirming the appointment. The technical data of the connection is processed because you choose to open the calendar or the link, after the contact page informs you that the calendar is provided by Cal.com.
• International transfer: this data is sent to the United States. By checking that box, you grant us your express and unequivocal authorization for that transfer, in accordance with article 26 of Law 1581 of 2012.
• How to exercise your rights: you can reschedule or cancel the appointment with the link in the confirmation email. To know, update, rectify or delete your data, or revoke your authorization, write to us at the channel indicated in the inquiries and claims section.

11 Analytics with Google Analytics

If you authorize it in the cookie banner, we measure the use of this site with Google Analytics 4. If you do not authorize it, we do not load any Google script or send Google any data. These are the conditions of that processing:

• Data processor (encargado del tratamiento): Google LLC, in the United States.
• Purpose: to know how many people visit the site, where they come from, which pages they view, how many submit the contact form or click the main invitation to book a diagnostic or the link to book it online, how many open the booking calendar and how many bookings are confirmed in it, in order to make decisions about the content and the business activity of the site.
• Data processed: the online identifiers stored in the cookies listed in our cookie policy, the pages visited and the referring page, the date and time of the visit, the approximate location derived from the IP address, the device type, the browser and the language, and the five events of our own: the successful submission of the form, the click on the main invitation, the click on the link to book online, the opening of the booking calendar and the confirmation of a booking in that calendar. We never send Google your name, your email, your phone number, what you write in the form or the details of your booking.
• Basis for processing: your prior, express and informed authorization, which you grant with the “Accept” button of the cookie banner.
• How to withdraw it: at any time, with the “Cookie preferences” link in the page footer, by choosing “Reject”. From that moment on, we stop sending data to Google and we delete the Google Analytics cookies of this site. You can also write to us at the channel indicated in the inquiries and claims section.
• International transfer: this data is sent to the United States. By accepting, you grant us your express and unequivocal authorization for that transfer, in accordance with article 26 of Law 1581 of 2012 (Ley 1581 de 2012).
• Retention: event and user data are kept in Google Analytics for 14 months. Once that period has ended, they are deleted.

We do not use this data for advertising: we keep Google signals and ads personalization turned off, and we do not link Google Analytics with Google Ads.

Your decision is stored in your browser, with its date and the version of this policy, for 12 months. When that period ends or the version of this policy changes, we ask you again.

12 Effective date and changes to this policy

This policy is effective as of November 3, 2026 and will remain in force for as long as Klydo S.A.S. processes personal data. The databases will remain in force for as long as necessary to fulfill the purposes described here.

Any substantial change to this policy will be communicated to you in a timely manner through this website, before it is implemented. For more information about the use of cookies, see our cookie policy and our terms of use.