Personal data processing policy

Version 1.0 · in force since November 5, 2026

This is a translation for reference. In case of any discrepancy, the Spanish version prevails.

1. Data controllers

SEITON VP S.A.S. (en constitución) is not yet registered in the commercial registry. Until it is registered, its founding partners, acting on behalf of the company being incorporated, are responsible for processing your data (article 7 of Law 1258 of 2008):

• Controllers: Iván Manuel Parra Reyes and Yohan Valencia Muñoz, founding partners
• Domicile: Cali, Valle del Cauca, Colombia
• Address: Carrera 97 # 45-11, barrio Calicanto, Cali, Valle del Cauca, Colombia
• Email for personal data matters: datos@seitonvp.com
• Phone: +57 305 249 6478

When the company is registered and takes over the processing, we will tell you by email before it happens (article 5 of Decree 1377 of 2013).

2. Legal framework

This policy is governed by Colombian Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in the Single Regulatory Decree for the trade sector, Decree 1074 of 2015) and any rules that amend or supplement them.

3. Data we collect and the purpose of each item

We collect the data you type into the forms and, when you submit them, the technical data of the record described below. In addition, our provider Cloudflare processes the IP address and technical browser data of every visit to deliver and protect the site (section 10 and Cookie policy). We do not ask for identity documents, addresses, dates of birth or sensitive data. The site is aimed at businesses and adults, and we do not knowingly collect data about children or adolescents. Please do not include sensitive data in your message.

Contact and demo request form

Investor information request form

Record of your authorization. When you submit a form we keep a record to prove your authorization, as the law requires: a record number, the date and time, the form and the language, the page address, the version and digital fingerprint (SHA-256) of the documents you accepted, the exact text of each checkbox and its value, your email address, a fingerprint of your IP address (we do not store the readable IP) and your browser identifier (user-agent). This data is used only to prove the authorization, to handle your rights and, in the case of the IP fingerprint, to limit abusive submissions from the same connection.

4. Processing and purposes

We collect, store, consult and use your data, and transmit it to the providers listed in section 10, only to:

• reply to your request;
• arrange and give the demo you requested;
• send you the investor information you requested;
• keep proof of your authorization and handle your inquiries and claims;
• protect the forms against abusive submissions.

We do not sell or assign your data to third parties. We will not send you news, promotions or advertising: if we ever wanted to, we would first ask for a separate, express authorization, and you could withdraw it at any time through a simple mechanism.

5. Authorization

Before submitting a form, you must tick two separate checkboxes, which are never pre-ticked: one to accept the Terms and conditions, and another to authorize the processing of your data under this policy, including the international transfer and transmission explained in section 10. Without both checkboxes the form is not sent. Silence or inactivity is never taken as authorization.

6. Rights of the data subject

As the data subject, you have the right to (article 8 of Law 1581 of 2012):

• know, update and correct your personal data;
• request proof of the authorization you gave;
• be informed, upon request, of how your data has been used;
• file complaints with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio) for breaches of the law, once the inquiry or claim procedure with us has been completed (article 16 of Law 1581 of 2012);
• revoke the authorization and request the deletion of your data at any time, unless you have a legal or contractual duty to remain in the database;
• access your personal data free of charge.

These requests are free of charge. If, once the deadline has passed, we have not deleted your data or revoked the authorization, you can ask the Superintendence of Industry and Commerce to order it (article 9 of Decree 1377 of 2013).

7. Procedure for inquiries and claims

You, your successors or your representative can exercise your rights by writing to datos@seitonvp.com, stating your name, your email, what you are requesting and, if you have it, your record number. To protect your data, we reply to the email address in your authorization record. If you write from a different address, we will ask you to verify your identity.

• Inquiries: answered within a maximum of ten (10) business days from receipt. If that is not possible, we will tell you why and give you a new date, no more than five (5) additional business days later (article 14 of Law 1581 of 2012).
• Claims (correction, update, deletion, revocation or alleged non-compliance): answered within a maximum of fifteen (15) business days from the day after receipt. If that is not possible, we will tell you why and give you a new date, no more than eight (8) additional business days later. If the claim is incomplete, we will notify you within five (5) days of receipt so that you can complete it. If two (2) months pass from that request without you providing the information, the claim will be considered withdrawn. Within two (2) business days of receiving the complete claim, your data will be marked with the legend “claim in progress” and its reason, until it is decided (article 15 of Law 1581 of 2012).

Revocation and deletion. If you revoke the authorization or request deletion, we stop using your data for the purposes in section 4 and delete your messages. The record of your authorization is not deleted: it is marked as revoked and used only to prove that the authorization existed and that you revoked it, because the law requires us to keep a copy of the authorization (article 17, literal b, of Law 1581 of 2012). It is deleted at the end of the period in section 11.

8. Responsible area

Inquiries and claims about personal data are handled by SEITON’s General Management, exercised by its two founding partners, at the email in section 7.

9. Contact by phone, messaging or email

We contact you only to reply to the request you made and only through the channels you gave us and authorized in the form. In compliance with Law 2300 of 2023 (articles 2, 3 and 5), we apply these rules to everyone, whether consumers or businesses:

• only Monday to Friday from 7:00 a.m. to 7:00 p.m. and Saturdays from 8:00 a.m. to 3:00 p.m. (Colombia time); never on Sundays or public holidays;
• no more than once on the same day, and not through several channels in the same week;
• if you ask us for another time or channel, we will only do so at your express, separate request.

These rules apply to contacts we initiate. If you write to us or call us, we reply in that same conversation, within the hours above.

10. Processors, transmission and international transfer

To run the site, keep the record and receive notice of your request, we use providers that process the data on our behalf (processors). Before using each of them we enter into a data transmission contract that requires it to process the data only according to our instructions and this policy, securely and confidentially (article 25 of Decree 1377 of 2013):

In addition, Cloudflare uses Turnstile’s technical signals (IP address, TLS fingerprint, user-agent and site key) as a controller in its own right to improve its bot detection, under its Turnstile Privacy Addendum. To that extent there is an international transfer to Cloudflare, Inc., in the United States, which your authorization also covers.

This means your data is transmitted to Cloudflare, Resend and Google, and transferred to Cloudflare, outside Colombia. That is why we ask for your express authorization to do so in the data checkbox of the form (article 26, literal a, of Law 1581 of 2012). If you do not give it, we cannot receive the form. You can call us at +57 305 249 6478. If you prefer to write to the email in section 7, please note that email is also processed on the servers of the providers in this table.

11. Retention

• Messages: kept for up to twelve (12) months after our last communication with you. If a contract results from the request, they are kept according to that contract. In the site’s database, the message is kept only until the email notice reaches us, and never for more than thirty (30) days.
• Authorization records: kept while we process your data and for three (3) more years, which is the limitation period for the authorities’ power to impose sanctions (article 52 of Law 1437 of 2011), unless an administrative or judicial proceeding is under way, in which case they are kept until it ends. They are then deleted.
• Backups: the database provider keeps automatic backups for up to thirty (30) days. Anything deleted also disappears from those backups when that period ends.

12. Security

We protect your data with encrypted connections, anti-bot verification, technical logs without personal data, access restricted to the people who handle requests, and a records log that cannot be modified or deleted from the site, with a cryptographic fingerprint of each record, computed with a secret key that is not stored in the database, which makes it possible to detect whether anyone modifies it.

13. National Database Registry

Under article 2.2.2.26.1.2 of Decree 1074 of 2015 (amended by Decree 090 of 2018), companies with total assets above 100,000 UVT and public legal entities must register their databases with the Superintendence of Industry and Commerce (Registro Nacional de Bases de Datos). If the company exceeds that threshold, it will register its database immediately and no later than within the following two (2) months. This does not exempt it from the other duties under the law, which are complied with from now on.

14. Validity

This policy is in force since November 5, 2026. The database will remain in force for as long as SEITON carries on its activity, and each item of data is kept only for the periods in section 11. If we make substantial changes to this policy, we will notify you by email and publish them on the site before applying them, with a new version number and date. If the change concerns the purpose of the processing, we will ask you for a new authorization. Previous versions are kept.