Privacy Policy

Data controller

The controller (responsable del tratamiento) is XPTNOVA S.A.S., a company with tax identification number (NIT) 901.780.408-5, domiciled in Pereira, Risaralda, Colombia, and registered with the Chamber of Commerce of Pereira under commercial registration number 18214018.

The contact channel for any personal data matter is the email address jp@xptnova.com. The company's website is xptnova.com.

Scope

This policy applies to the personal data that XPTNOVA S.A.S. processes in Colombia or abroad, in two different capacities.

• As controller, when it decides on the processing of the data of its business contacts, clients, suppliers, candidates and employees, and of the people who write to it.
• As processor (encargado del tratamiento), when it processes data of a client's employees or third parties on behalf of that client and following its instructions. This is the case of the people interviewed with BrainNova and of the data a client connects to DataNova.

In the second case the client is the controller, and the processing is governed by the contract signed with the client and by the instructions it gives. The section on processing as processor explains how this policy applies in that case.

Definitions

For the purposes of this policy, the definitions of article 3 of Law 1581 of 2012 and of Decree 1377 of 2013 apply. The main ones are the following.

• Authorization is the prior, express and informed consent of the data subject to carry out the processing of their personal data.
• Personal data is any information linked or that may be associated with one or more identified or identifiable natural persons.
• Sensitive data is data that affects the privacy of the data subject or whose improper use may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs or membership in trade unions or social organizations, and data relating to health, sex life and biometric data.
• Controller is the natural or legal person, public or private, that by itself or in association with others decides on the database or on the processing of the data.
• Processor is the natural or legal person, public or private, that by itself or in association with others carries out the processing of personal data on behalf of the controller.
• Data subject is the natural person whose personal data are processed.
• Processing is any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
• Transfer is the sending of personal data by a controller or processor located in Colombia to a recipient that is itself a controller and is located inside or outside the country.
• Transmission is the communication of personal data inside or outside Colombia so that a processor carries out processing on behalf of the controller.

Principles

XPTNOVA S.A.S. applies the principles of article 4 of Law 1581 of 2012 to all processing.

• Legality. Processing is subject to the law and to the rules that implement it.
• Purpose. Processing serves a legitimate purpose, which is disclosed to the data subject.
• Freedom. Processing is carried out only with the prior, express and informed consent of the data subject, except in the cases the law exempts.
• Accuracy or quality. The information processed must be truthful, complete, accurate, up to date, verifiable and understandable.
• Transparency. The data subject may obtain at any time, and without restrictions, information about the existence of data concerning them.
• Restricted access and circulation. Data are processed only by persons authorized by the data subject or by law, and are not published on the internet or in other mass media unless access can be technically controlled.
• Security. Data are protected with the technical, human and administrative measures needed to prevent their tampering, loss, consultation, use or unauthorized or fraudulent access.
• Confidentiality. The people involved in processing keep the information confidential, even after their relationship with XPTNOVA S.A.S. ends.

Authorization

XPTNOVA S.A.S. requests the authorization of the data subject no later than the moment it collects their data, and informs them of the purposes of the processing and of their rights. Authorization may be given in writing, orally or through unequivocal conduct of the data subject, and is kept for later consultation.

Authorization is not required in the cases of article 10 of Law 1581 of 2012, among them data of a public nature, information requested by a public entity in the exercise of its legal functions or by court order, and cases of medical or health emergency.

Whoever writes to the email address of XPTNOVA S.A.S. authorizes, by that act, the processing of the data they send so that their message can be answered.

Data of business contacts and clients

Identification and contact data of the people who represent clients and interested companies are processed, such as name, position, company, email address and telephone number. The data of the people a client designates as users of the platforms are also processed, such as name, email address and position, along with the technical records generated by their use.

The purposes are the following.

• Answering requests, preparing proposals and maintaining the business relationship.
• Entering into, performing and monitoring contracts.
• Creating and managing platform access accounts and protecting their security.
• Providing support for the contracted services.
• Invoicing, collecting payments and meeting accounting and tax obligations.
• Sending information about the services of XPTNOVA S.A.S. when the data subject has requested or authorized it.

Supplier data

Identification, contact, tax and banking data are processed for suppliers who are natural persons, and for the representatives and contacts of suppliers that are legal entities.

The purposes are the following.

• Evaluating, selecting and contracting suppliers.
• Managing the contractual relationship and payments.
• Meeting accounting, tax and legal obligations.

Candidate and employee data

For candidates, the résumé and the data it contains are processed, such as education, experience, references and contact details. For employees, the data needed for the employment relationship are processed, such as identification, contact, social security enrollment and payment data.

The purposes are the following.

• Carrying out selection processes and verifying candidate information.
• Entering into and performing the employment contract.
• Paying payroll and meeting labor and social security obligations.
• Meeting the legal obligations of XPTNOVA S.A.S. as an employer.

The data of a candidate who is not hired are kept for future selection processes only when the candidate has authorized it.

Website visitor data

The xptnova.com website is static and informational. It has no forms, does not request personal data and does not use tracking cookies or analytics or advertising tools.

The technical server records of the hosting provider may include the visitor's IP address and browser. These records are used for the security and operation of the site. The section on cookies and website records expands on this information.

Data of people who write to XPTNOVA S.A.S.

When a person writes to jp@xptnova.com or to another address of XPTNOVA S.A.S., the data included in their message are processed, such as name, email address, company and the content of the communication.

These data are used to answer the message, handle the request and, if the person asks for it, start a business or employment relationship.

Processing as processor on behalf of clients

When a client contracts the services of XPTNOVA S.A.S., it may hand over or connect to the platforms personal data of its employees or third parties. In that case the client is the controller and XPTNOVA S.A.S. acts as processor.

XPTNOVA S.A.S. processes those data only on behalf of the client, following its instructions and within the terms of the contract. The client is responsible for obtaining the authorization of the data subjects when the law requires it.

A client's data are not sold, are not shared with other clients and are not used to train artificial intelligence models. Each client's data are isolated from those of any other client by controls in the database.

Queries and claims about those data are addressed to the client that acts as controller. If XPTNOVA S.A.S. receives one, it forwards it to the client and informs the data subject.

In interviews conducted with BrainNova, the following rules also apply.

• In the first turn, the interviewee is told that they are talking with an artificial intelligence, on whose behalf the interview is conducted and for which study.
• The person may decline to answer a question or stop answering whenever they wish.
• The full conversation, the time and the channel through which the link arrived are stored.
• No data from the person's telephone is stored.
• What the person says remains associated with their name and position within the client's account.

Sensitive data and data of minors

XPTNOVA S.A.S. does not request sensitive data or data of children and adolescents.

If it were ever necessary to process sensitive data, the data subject will be informed that they are not obliged to authorize its processing, which of the data are sensitive and what they will be used for, and their explicit authorization will be requested.

If a client connects to DataNova information containing sensitive data or data of minors, that processing is governed by the instructions of the client as controller and by the contract.

Rights of the data subject

Under article 8 of Law 1581 of 2012, the data subject has the following rights.

• To know, update and rectify their personal data, especially with respect to data that are partial, inaccurate, incomplete, fragmented or misleading, or whose processing is prohibited or has not been authorized.
• To request proof of the authorization granted, except when the law does not require it.
• To be informed, upon request, about the use that has been made of their data.
• To file complaints with the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio) for violations of the law, once the query or claim procedure before XPTNOVA S.A.S. has been exhausted.
• To revoke the authorization or request the deletion of their data when the processing does not respect the constitutional and legal principles, rights and guarantees.
• To access free of charge their personal data that have been processed.

Revocation and deletion do not apply when the data subject has a legal or contractual duty to remain in the database.

These rights may be exercised by the data subject, who must prove their identity, by their successors, by their representative or attorney, and by whoever acts under a stipulation in favor of another.

Procedure for queries

The data subject or their representative may consult the personal data held in the databases of XPTNOVA S.A.S. The query is sent to jp@xptnova.com, with the name of the data subject, the information requested and a contact detail for the answer.

The query is answered within a maximum of ten (10) business days from the date it is received. If it cannot be answered within that period, the interested party will be informed of the reason for the delay and the date on which it will be answered, which may not exceed five (5) business days after the first period expires. This is provided by article 14 of Law 1581 of 2012.

Procedure for claims

A data subject who considers that their data should be corrected, updated or deleted, or who notices a breach of the law, may file a claim under article 15 of Law 1581 of 2012. The claim is sent to jp@xptnova.com and must contain the following elements.

• The identification of the data subject.
• A description of the facts giving rise to the claim.
• The physical or electronic address to receive the answer.
• The documents the data subject wishes to rely on.

If the claim is incomplete, the interested party will be asked, within five (5) days after it is received, to correct the deficiencies. If two (2) months pass from that request without the interested party submitting the information, the claim will be deemed withdrawn.

Once the complete claim is received, the note “claim in process” and its reason will be added to the database within no more than two (2) business days. The note remains until the claim is decided.

The claim is answered within a maximum of fifteen (15) business days from the day after the date it is received. If it cannot be answered within that period, the interested party will be informed of the reason for the delay and the date on which it will be answered, which may not exceed eight (8) business days after the first period expires.

If XPTNOVA S.A.S. is not competent to resolve the claim, it will forward it to the appropriate party within a maximum of two (2) business days and will inform the interested party.

Prerequisite for filing a complaint

Under article 16 of Law 1581 of 2012, the data subject or their successor may file a complaint with the Superintendence of Industry and Commerce only after exhausting the query or claim procedure before XPTNOVA S.A.S.

Responsible area and contact channel

XPTNOVA S.A.S. directly handles the requests, queries and claims of data subjects. The contact channel is the email address jp@xptnova.com.

Information security

XPTNOVA S.A.S. applies technical, human and administrative measures to protect personal data against tampering, loss, consultation, use or unauthorized or fraudulent access.

Each client's data are isolated from those of any other client by controls in the database. The people involved in processing are bound to keep the information confidential.

International transmission and transfer of data

To provide its services, XPTNOVA S.A.S. uses cloud infrastructure and language model providers whose servers are located outside Colombia, mainly in the United States. For this reason personal data may be subject to international transmission or transfer, as the case may be.

These transfers are made in accordance with article 26 of Law 1581 of 2012 and the rules that regulate it. By authorizing the processing of their data under this policy, the data subject acknowledges and accepts that their data are processed on servers located outside Colombia.

When XPTNOVA S.A.S. acts as processor, the sending of client data to these providers is also governed by the contract with the client.

Data retention

Personal data are kept for the time needed to fulfill the purposes for which they were collected and the applicable legal, accounting and tax obligations. After that time, they are deleted.

The data that XPTNOVA S.A.S. processes as processor are kept and deleted according to the contract with the client and its instructions.

Cookies and website records

The xptnova.com website does not use tracking cookies or analytics or advertising tools. It has no forms and does not request personal data.

The site's hosting provider keeps technical server records. These records may include the visitor's IP address and browser, and are used for the security and operation of the site.

Changes to this policy

XPTNOVA S.A.S. may modify this policy. The current version is published on this site with its effective date.

If a change affects the identification of the controller or the purposes of the processing, it will be communicated to data subjects before it is applied and, when the law requires it, a new authorization will be requested.

Effective date

This policy is effective as of October 18, 2026. The databases that XPTNOVA S.A.S. manages as controller remain in force for as long as the purposes described in this policy continue.