Personal data processing policy

1. Who the controller is

Inversiones Nupa S.A.S., a Colombian company domiciled in Toluviejo, Sucre, is the controller of the personal data collected through the website and the services of Kembrio, its trade name. Its address is Km 4, sector vía a San Onofre, Toluviejo, Sucre, Colombia.

For any matter related to personal data, the data subject may write to datos@kembrio.com.

2. Who this policy applies to and what data is processed

This policy applies to the personal data of:

• People who request a demo or information on the website: name, company, email, phone, country and city, and whatever they write in the message.
• Clients, their representatives and their contacts: name, job title, ID document, email, phone and the data needed for invoicing and collection, such as the legal name, tax ID, billing address and billing email.
• Whoever accepts the Kembrio agreement on behalf of a company: name, ID document and job title, and the record of acceptance (who accepted and on behalf of which company, the version accepted, the date and time, and the internet address and browser from which it was accepted).
• Kembrio users: name, email, role and the log of their activity in the system, which is kept for account security.
• Subscription payments: the result of each charge, its amount and date, and a reference to the payment method. Inversiones Nupa S.A.S. does not receive or store full card numbers: they are received directly by whoever processes the payment (section 10).
• Suppliers and partners: contact details and the data needed to contract with and pay them.

3. What the data is used for

Data is processed only for these purposes:

• Responding to demo or information requests, and commercial follow-up.
• Providing the Kembrio service: creating and managing accounts, providing support and sending notices about the service.
• Recording acceptance of the agreement and keeping proof of it.
• Invoicing, collecting and meeting accounting, tax and legal obligations.
• Keeping the system secure, preventing fraud and responding to requests from authorities.
• Sending information about Kembrio, news or events, only when the data subject has authorized it separately. They may ask at any time to stop receiving it.

4. Basis for each use

Each use of the data rests on the following:

• Demo requests: the authorization the data subject gives by checking the box on the form.
• Account, users and acceptance of the agreement: the agreement the company accepts and the authorization given when accepting it.
• Invoicing, collection and payments: the agreement and accounting, tax and legal obligations.
• System security and fraud prevention: the agreement and the security duty the law places on whoever processes data.
• Commercial information: the data subject’s separate authorization, which they may withdraw whenever they wish.

5. Data that client companies store in Kembrio

The companies that subscribe to Kembrio store data about their own customers, employees, drivers and suppliers in the system. For that data, each company is the controller and Inversiones Nupa S.A.S. acts as processor: it processes the data only to provide the service, following the company’s instructions and with the security measures in this policy. Anyone who wants to exercise their rights over that data should first contact the company that collected it; Inversiones Nupa S.A.S. will help that company respond. The conditions of that processing are set out in the Terms and conditions of the service.

6. Authorization

Data is collected with the prior, express and informed authorization of the data subject, given, for example, by checking the authorization box on the website form or by accepting the service agreement. Proof of that authorization is kept: what was authorized, under which version of this policy and when.

No authorization is required in the cases set out in article 10 of Ley 1581 de 2012, such as data of a public nature or data requested by an authority in the exercise of its functions.

7. Sensitive data and data of minors

No sensitive data (such as racial origin, health, sexual orientation, beliefs or biometric data) is requested through the website. If it were ever needed, it would be requested with express authorization, and the data subject would not be required to provide it.

The website and the services are not directed at minors, and data of minors is not knowingly collected.

8. Rights of the data subject

As the holder of their data, every person has the right to:

• Know, update and correct their personal data.
• Request proof of the authorization they gave, except in cases where the law does not require it.
• Be informed, on request, about how their data has been used.
• File complaints with the Superintendencia de Industria y Comercio for violations of the law, after having made their inquiry or claim to the controller.
• Revoke the authorization or request the deletion of their data at any time, unless there is a legal or contractual duty to keep it.
• Access their personal data free of charge.

9. How to make an inquiry or a claim

The data subject, their successors or their representative may write to datos@kembrio.com, stating their name, ID document, how to contact them and what they are requesting. The area that handles these requests is the Management of Inversiones Nupa S.A.S..

Inquiries: they are answered within a maximum of ten (10) business days from receipt. If that is not possible within that time, the reason and the date on which the answer will be given are reported, which will not exceed five (5) additional business days.

Claims (correction, update, deletion or revocation, or a breach of the law): they must include the identification of the data subject, a description of the facts, the address where they wish to receive the answer and the documents they wish to rely on. If the claim is incomplete, the data subject is asked to complete it within five (5) days of its receipt; if two (2) months pass from that request without the information being provided, the claim is deemed withdrawn. If whoever receives the claim is not competent to resolve it, they forward it within a maximum of two (2) business days to the appropriate party and inform the data subject.

Within a maximum of two (2) business days from receipt of the complete claim, the data is marked with the legend “reclamo en trámite” (claim in progress) and its reason, until it is resolved. The claim is answered within a maximum of fifteen (15) business days from the day after its receipt; if that is not possible, the reason and the date on which the answer will be given are reported, which will not exceed eight (8) additional business days.

10. Who else may process the data

To provide the service, Inversiones Nupa S.A.S. relies on providers of hosting infrastructure, email, payments and, when the client company uses the quote assistant, artificial intelligence, which process the data as processors, only for those purposes and under agreements that require them to protect it. Some of those providers have their servers outside Colombia, in countries with adequate levels of protection or with the safeguards the law requires; for that reason, by authorizing the processing, the data subject is aware of and accepts that international transmission.

Subscriptions paid outside Colombia are sold and charged by Paddle.com, a reseller that acts as the merchant of record for those purchases: it receives payment and billing data directly from the buyer and processes it as controller, under its own privacy policy. In Colombia, charges are processed by the payment gateway Wompi, which receives the payment method data directly and processes it under its own policy.

The data may also be accessed, only to the extent necessary and under a duty of confidentiality, by the professional advisers of Inversiones Nupa S.A.S. (lawyers, accountants and auditors), and by authorities when the law requires it or when they order it in the exercise of their functions.

The data is not sold or transferred to third parties for their own purposes.

11. Security

Technical, human and administrative measures are applied to protect the data against loss, unauthorized consultation, use or access: a connection that is always encrypted, access only for the people who need it for their role, separation of each client company’s information, and recovery copies.

12. Cookies and what is stored in the browser

The website does not use cookies or tracking or advertising tools.

The Kembrio application stores in each user’s browser what it needs to work, such as the open session. It is not used for advertising or to follow the person outside Kembrio, and it can be deleted from the browser itself. When paying, Paddle or Wompi may use their own cookies, under their own policies.

13. How long data is kept

The data of people who request a demo is kept for up to 24 months after the last contact, unless the person asks for it to be deleted sooner or becomes a client. Other data is kept for as long as the relationship with the data subject lasts and, after that, for the time required by accounting, tax or legal obligations.

The account data of a client company, and the data it stores in Kembrio, is kept for as long as the agreement lasts; when it ends, what the Terms and conditions say about the copy and deletion of data applies. The record of acceptance of the agreement and the billing data are kept for the time the law requires and the time needed to prove what was agreed.

14. Effective date and changes

This policy (version 1.1) is effective as of 12 October 2026. If it changes in any substantial way, the new version will be published on this same page before it is applied, and notice will be sent by email to those with a current relationship; when the law requires it, a new authorization will be requested.

The databases of Inversiones Nupa S.A.S. will remain in force for as long as it provides its services and for any additional time required by applicable rules, with the retention periods in the previous section.