Personal Data Processing and Privacy Policy

BibiTech Solutions S.A.S. · Last updated: August 1, 2026

1. Definitions

2. Processing principles

BibiTech Solutions processes personal data in accordance with the principles established in Colombian Law 1581 of 2012: legality, purpose, freedom, transparency, restricted access and circulation, security, and confidentiality.

3. Data Controller

BibiTech Solutions S.A.S., a company incorporated in Colombia (NIT 901389051-4), with commercial presence and technology operations in the United States.

4. What data we collect

a) Data you provide through the contact form: full name, email, phone (optional), company (optional), the message or inquiry you send us, and optional information about your need (area of interest, priority, and company size).

b) Technical data automatically recorded for security and functionality: IP address, browser type, operating system, technical device information, request identifier, and timestamp.

We do not collect sensitive data (Law 1581, art. 5) or data from minors intentionally.

Commercial purposes are optional and require your separate consent. You may receive a response to your inquiry without accepting commercial communications, and you may withdraw that consent at any time.

6. Authorization

By checking the acceptance box on the form, you grant your prior, express, and informed authorization for the processing of your data in accordance with this Policy (Law 1581 of 2012, art. 9). We record the date and time of such authorization as evidence.

7. Requests received through other channels

When a data subject contacts us by email or other official channels, we will apply the principles described in this Policy insofar as they are applicable.

8. Cookies and similar technologies

We use only the technical cookies and mechanisms necessary for the operation and security of the site (including infrastructure and protection provided by Cloudflare). If we incorporate additional cookies, we will inform you through a specific Cookie Policy.

9. Use of artificial intelligence

Some of our services may rely on artificial intelligence tools to assist analysis, translation, automation, or content generation processes. When this occurs, we implement reasonable controls to protect the information and maintain human oversight where appropriate. The use of AI tools does not entail automated decisions that produce legal effects on data subjects.

10. Your rights as a data subject

Under Colombian Law 1581 of 2012 and applicable regulations in your jurisdiction, you have the right to know, update, and rectify your data; request proof of authorization; be informed of its use; revoke authorization and/or request deletion of your data; withdraw consent for commercial communications at any time; request portability of your data where applicable; and file complaints with the Superintendency of Industry and Commerce (SIC) in Colombia.

Where applicable under the legislation in force in the relevant jurisdiction (for example, for residents of certain U.S. states), data subjects may exercise the rights recognized by such regulations, including access, correction, deletion, and the option to opt out of commercial communications.

How to exercise your rights: send your request to [email protected] stating your name, the right you wish to exercise, and your contact details. We will endeavor to respond within the applicable legal terms and, where possible, within no more than ten (10) business days.

11. Information security

We apply reasonable technical and organizational controls under the Security by Design principle, including encryption in transit via HTTPS, access controls, authentication, and audit logs where appropriate, aimed at protecting the confidentiality, integrity, and availability of information. If we detect a security incident affecting your data, we will act in accordance with applicable regulations.

12. Retention periods

We retain your data for as long as necessary to fulfill the stated purposes. As a general reference: contact form data up to 24 months; commercial prospects until consent is revoked; contractual relationships according to applicable legal obligations; technical data/logs up to 12 months. Once the purpose is fulfilled, data will be deleted or anonymized where appropriate.

13. Transfer and processing by third parties

To operate our services we use Processors (email and infrastructure providers) that process data solely according to our instructions and are not authorized to use it for their own purposes. Since we operate between Colombia and the USA, your data may be stored or processed in both countries. We adopt reasonable contractual and organizational measures to protect your personal data during such transfers.

14. Ownership of the information and digital assets provided

The data subject retains ownership and the rights corresponding to them over the information and digital assets provided through our channels. BibiTech Solutions processes them solely for the purposes described in this Policy. Except with the express authorization of the data subject or the client responsible for such data, BibiTech Solutions will not use that information for purposes other than those described herein.

Some services may require the processing of information and digital assets provided by the client —including content, images, translations, configurations, metadata, and AI-generated assets— in order to generate content, automations, or digital assets. Such processing will be carried out solely for the purposes authorized by the data subject or the client responsible for such data.

15. Applicable law

This Policy is interpreted in accordance with the applicable legislation depending on the relevant jurisdiction and the type of processing carried out.

16. Changes to this Policy

We may update this Policy. We will publish the current version on this page with its update date. Substantial changes will be communicated through appropriate means.

17. Acceptance

Use of the contact form and checking the authorization box imply acceptance of this Personal Data Processing and Privacy Policy.