Personal data processing policy

1. Who is the controller

DIGITAL FUTURE ENTERPRISE SAS, a Colombian company domiciled at Carrera 16 # 55-09, Onepot Coworking, Office 222, Bogotá, Colombia, is the controller of the personal data described in this policy.

Contact email for everything related to personal data: develop@digitalfuture.com.co

This policy is issued in compliance with Colombian Law 1581 of 2012, Decree 1074 of 2015 and any rules that amend or regulate them.

2. Who it applies to

This policy covers two different groups, with different processing:

a. People who visit our website or write to us. Data you give us yourself when filling in a form, leaving a comment or writing to us, plus the technical browsing data described in our privacy and cookie policy.

b. Companies and establishments to which we offer our services. Business contact data that we obtain from public sources, as explained in section 3.

3. Where we obtain business contact data

When we write to a business with which we had no prior relationship, its data comes from publicly accessible sources: open directories of establishments, openly licensed collaborative maps and the information the business itself publishes on its website or social media.

We do not buy databases, we do not exchange them with third parties and we do not extract data from services that forbid it in their terms of use.

We process only business contact data: the establishment’s name, address, website and the emails and phone numbers that the business itself publishes in order to be contacted. When an email address identifies a natural person rather than the establishment, we do not use it for business contact.

Next to each record we keep its provenance —the source, its version and the date it was obtained— precisely so we can answer accurately if you ask us where your data came from.

4. What we use it for

Purpose	Group
Answer inquiries and requests you make to us	a
Provide the contracted services and invoice them	a
Present our web and app development services to businesses that might need them	b
Prepare a technical diagnosis of the business’s public website, to support that presentation	b
Handle deletion requests and maintain the list of people who asked not to be contacted	a and b
Comply with legal, accounting and tax obligations	a and b

We do not use this data to profile natural persons, we do not transfer or sell it to third parties, and we do not use it for purposes other than those listed here.

5. Your rights

As the data subject, the law recognizes your right to:

• Know what data of yours we hold, free of charge and as often as you ask.
• Update and correct it when it is inaccurate, incomplete or misleading.
• Request proof of the authorization given, except where the law does not require it.
• Be informed about how we have used it.
• Withdraw the authorization or request deletion of your data, when there is no legal or contractual duty requiring us to keep it.
• File complaints with the Superintendence of Industry and Commerce for violations of the law, once the inquiry or claim procedure with us has been exhausted.

6. How to exercise them

Write to develop@digitalfuture.com.co stating your name or that of the establishment, the data you want to know, correct or delete, and an address where we can reply.

Replying to an email from us asking us not to write to you again is enough: we do not require any form.

Deadlines. Inquiries are answered within ten (10) business days of receipt; if that is not possible, we will tell you the reasons and the date on which it will be handled, which will not exceed five (5) business days after the first deadline expires. Claims are handled within fifteen (15) business days, extendable by eight (8) more business days, informing you of the reasons and the date of the reply.

7. Deletion and exclusion list

When you ask not to be contacted, your record moves to a permanent exclusion list that is checked before every message. We keep in it only the minimum data needed to recognize you and not write to you again —that is its purpose and the reason it is not deleted— and that record is not used for any other purpose.

We do not reactivate: once on the list, you do not leave it unless you ask.

8. How long we keep it

Business contact data is kept while the purpose in section 4 remains valid and, at most, two (2) years from the last contact, after which it is deleted. Client data is kept for the duration of the contractual relationship and for the period required by applicable legal, accounting and tax obligations. Exclusion list records are permanent, for the reason explained in section 7.

9. Security

We apply technical and administrative measures to protect data against unauthorized access, loss or alteration: access restricted to the staff who need it, two-factor authentication in internal systems, encryption in transit and storage with providers that offer adequate security guarantees.

Some of our infrastructure providers are located outside Colombia. Using them involves an international transfer of data, covered by the contractual security and confidentiality guarantees those providers give.

10. Effective date and changes

This policy is effective from September 4, 2026 and was last updated on September 4, 2026. Any substantial change will be published on this same page with its new update date. The databases will be kept for as long as the purposes in section 4 remain.