Privacy Policy and Personal Data Processing

1. General Information

This policy governs the processing of personal data of clients, users, suppliers, or any other natural or legal person who has a relationship with Consultoría en Tecnología Sostenible S.A.S. BIC, incorporated under the laws of the Republic of Colombia, domiciled in Bogotá (hereinafter Sustek.co).

Sustek.co is committed to protecting the privacy of all information that may be associated with or related to identified or identifiable natural or legal persons (hereinafter Personal Data) to which Sustek.co has access in the course of its business activities.

The company collects, through its various information channels, data relating to identification (name, ID number, age, or gender), contact information (phone number, email address, or physical address), consumption preferences, website visits and online behaviour, financial information, and other data relevant to commercial operations. This information may be obtained directly from the data subjects or through Sustek.co's Internet platforms, subject to prior authorisation by the client.

By submitting their data and information, the data subject expressly consents to the use of such data as described in this Privacy Policy and Personal Data Processing Policy.

2. Scope of this Policy

This Policy applies generally to Sustek.co's clients, business partners, affiliated merchants, suppliers, employees, collaborators, contractors, and any person whose Personal Data is or will be processed by the company (hereinafter Data Subjects). Its purposes are to:

Guarantee the rights of Data Subjects.
Inform about the mechanisms and procedures for exercising those rights.
Address questions, complaints, and claims.
Disclose the purposes for which Personal Data is used in the course of business.

This Policy applies throughout the territory of the Republic of Colombia by Sustek.co, its employees, and, where applicable, by those third parties with whom the company agrees to carry out any activity relating to the Processing of Personal Data.

3. Processing

In compliance with Decree 1377 of 2013, Consultoría en Tecnología Sostenible S.A.S. BIC, in the course of its business activities, will collect, use, manage, store, analyse, anonymise, index, segment, profile, compile, process, transmit, transfer, verify, charge, and share information with credit bureaus when necessary.

4. Purposes

Personal Data processed by the company will be used for the following purposes:

To offer loyalty programmes, promotions, and discounts.
To inform about new products and services, both proprietary and third-party.
To track Data Subjects' behaviour and consumption preferences.
To create profiles of Data Subjects based on their consumption preferences and online behaviour.
To send information about news, updates, and promotions.
To send information about CRM programmes, both proprietary and third-party.
To analyse and optimise existing and future products and services.
To export information on human resources, credit risks, and anti-money laundering controls.
To build segmented databases.
To carry out archiving, updating, storage, and information processing activities.
To promote and market new and existing products and services.
To index information and Personal Data based on Data Subjects' behaviour.
To carry out marketing activities and send information for advertising purposes.
To conduct statistical analysis to optimise service performance.
To guarantee the effectiveness and security of transactions carried out on Sustek.co.
To personalise the website and/or mobile applications according to the user's tastes and interests.
To fully comply with services agreed with clients and users.
To manage requests, complaints, and claims submitted by users and third parties.
To send commercial information and offers for Sustek.co services.
To conduct market research, surveys, and trend analysis.
To transmit Personal Data to third parties for the purpose of fulfilling the service offered through Sustek.co.
To manage information necessary for compliance with tax and commercial registration obligations.
To identify users when they access the Website.
To proceed with billing and collection for the service.
To transmit and/or transfer Personal Data to service companies or outsourcing firms that contribute to improving operations through Sustek.co.

The Data Subject expressly acknowledges that the commercial information collected will be used for commercial purposes, including the sending of advertising information via: (i) email, (ii) SMS text messages, and/or (iii) telephone calls.

5. Rights of the Data Subject

Sustek.co is committed to protecting the privacy of Data Subjects and guaranteeing their habeas data rights. In accordance with Law 1581 of 2012 and Decree 1377 of 2013, the Data Subject holds the following rights:

To know, update, and rectify their personal data held by Sustek.co.
To request proof of the authorisation granted to Sustek.co.
To be informed about the uses or Processing of their Personal Data.
To file complaints with the Superintendence of Industry and Commerce for violations of Law 1581 of 2012, once the process before Sustek.co has been exhausted.
To revoke authorisation and/or request deletion of data when the principles and constitutional and legal guarantees are not respected.
To access, free of charge, their personal data that has been subject to Processing.

Data Subjects may exercise their rights by presenting their national ID or any identification document. Minors may exercise their rights personally or through their parents or guardians, who must provide the relevant documentation.

6. Information Collected

For the development of its business activities, Sustek.co will collect the following information:

Full name
Address
Email address
Date of birth
Phone number
Payment method details
Professional information, qualifications, and personal and professional references
Any other information required for the provision of the offered services

For services offered through Internet platforms, Sustek.co will also collect:

IP address, for the purpose of diagnosing server issues and administering the Website.
Email address for use of the Website.
Financial information for payment of services.

7. Sensitive Data

In the exercise of its commercial activities, the company may collect and process Sensitive Data, such as:

Images, photographs, and/or voice recordings.
Data that may lead to discrimination, such as information relating to political, religious, or philosophical affiliation.

This data will be processed with the highest security standards. Only authorised personnel will have access to such information.

8. Authorisation

The processing of data requires prior authorisation from the Data Subject. The company, its employees, and authorised third parties must collect Personal Data and ensure that the Data Subject is familiar with this document.

9. Procedures

9.1. Queries

Data Subjects or their successors may consult the personal information held in any of Sustek.co's databases. Query requests will be addressed within a maximum of ten (10) business days from the date of receipt. If it is not possible to address the query within this period, the interested party will be informed before the deadline, with the reasons for the delay and the date on which the query will be addressed, which may not exceed five (5) additional business days.

9.2. Claims

Data Subjects or their successors who believe that information in the database should be corrected, updated, or deleted may submit a claim to Sustek.co under the following rules:

The claim must include the Data Subject's identification, a description of the facts, their address, and any supporting documents.
If the claim is incomplete, the interested party will be asked to correct it within five (5) days of receipt.
If two (2) months pass from the date of the request without a response, the claim will be deemed withdrawn.
The maximum period to address the claim is fifteen (15) business days from the day following receipt.

9.3. Deletion

The Data Subject has the right, at any time, to request deletion of their Personal Data when:

The data is not being processed in accordance with the principles of Law 1581 of 2012.
The data is no longer necessary or relevant for the purpose for which it was collected.
The necessary period for the purposes for which it was collected has elapsed.

Sustek.co may deny this right when the Data Subject has a legal or contractual obligation to remain in the database, or when deletion would obstruct judicial or administrative proceedings.

9.4. Revocation of Authorisation

Data Subjects may revoke their consent to the processing of their Personal Data at any time, provided no legal provision prevents it. The revocation may be:

Total: Sustek.co must cease all processing of the Data Subject's data.
Partial: relating to specific types of processing, such as advertising or market research.

10. Data Transfer

The Data Subject expressly authorises Sustek.co to share their Personal Data with its business partners who will develop and execute the service chosen by the user, as well as to retain, update, process, consult, and process them in the ways established in this Policy.

11. Cookies

Sustek.co uses cookies — small units of information temporarily stored on the user's computer hard drive — useful for navigating the site. They are used for session control, enhanced navigation, and storage of identification information.

Users may prevent cookies by changing their browser settings, or delete them at any time from the browser's Internet options.

12. Minors

Sustek.co's services are only available to persons with legal capacity to contract. Sustek.co will not process sensitive data of minors.

13. Security

In accordance with the security principle established in Law 1581 of 2012, Sustek.co will adopt the technical, technological, human, and administrative measures necessary to safeguard records, preventing their alteration, loss, consultation, use, or unauthorised or fraudulent access.

14. Handling of Requests

To exercise your rights or for any query, complaint, or request related to your personal data, please contact our administration team:

📧 contact@sustek.co

15. Update of Information in the RNBD

In accordance with External Circular No. 002 of 3 November 2015 of the Superintendence of Industry and Commerce, Sustek.co will update the information contained in the National Database Registry (RNBD).

16. Modifications

Sustek.co reserves the right to modify this policy at any time and without prior notice. Any modification will take effect from its publication on the corresponding channel.

17. Effective Date

This data policy is effective as of 10 August 2025.

Personal Data stored, used, or transmitted will remain in Sustek.co's database for as long as necessary for the purposes mentioned in this Policy.

Consultoría en Tecnología Sostenible S.A.S. BIC — NIT 901.966.636-8 — Bogotá D.C., Colombia
sustek.co | contact@sustek.co