Privacy and Data Protection Policy

1. Data Controller

Base Computing S.A.S., a company incorporated in the Republic of Colombia, is the controller for personal data collected through the Trace service and its associated channels.

• Legal name: Base Computing S.A.S.
• Domicile: Medellín, Colombia.
• Website: basecomputing.com.co
• Data protection contact: social@basecomputing.com.co

2. Regulatory framework

Personal data processing is governed primarily by Colombian Law 1581 of 2012, Decree 1377 of 2013, the SIC Circular and related regulations. For data subjects located in other jurisdictions, Base Computing also observes the general principles of minimization, purpose limitation, legality and proportionality.

3. Definitions

• Data subject: the individual whose personal data is processed.
• Controller: Base Computing, which decides on the processing.
• Processor: any party processing data on behalf of the Controller.
• Personal data: information that identifies or can identify a natural person.
• Sensitive data: data that affects privacy or whose misuse may cause discrimination. Trace does not request sensitive data.
• Authorization: prior, express and informed consent of the data subject.

4. Categories of data we process

4.1 Customer data (contracting user)

• Identification: first name, last name, ID number, account creation date.
• Contact: email, phone, address.
• Business: legal name, tax ID, business address, sector, size.
• Account: encrypted credentials, preferences, configuration.
• Billing: payment history, amounts. Payment method data is processed by PCI-DSS certified payment providers; Base Computing does not store full card numbers.
• Usage: activity logs, IP, browser, OS, anonymized feature-usage metrics.

4.2 Third-party data uploaded by the Customer

When the Customer uploads to the service personal data of their own customers, suppliers or end users (name, email, phone, purchase history), Base Computing acts as Processor. The Customer, as Controller, represents having obtained valid authorization from those data subjects to have their data processed in SaaS platforms and shared with processors.

5. Purposes of processing

Base Computing processes personal data for the following purposes:

• Create, maintain and manage the Customer's Trace account.
• Provide the contracted service and its features.
• Process payments, billing and tax obligations.
• Handle inquiries, requests, complaints and claims.
• Send operational communications (service changes, incidents, maintenance, term updates).
• Send commercial communications about Trace and Base Computing products, with the Customer's consent.
• Improve the service through aggregated and anonymized analysis.
• Comply with legal, regulatory and accounting obligations.
• Prevent fraud, abuse and security violations.

6. Data subject's authorization

By creating an account and accepting these terms, the data subject grants express, prior and informed authorization for processing their personal data under this Policy. Authorization may be revoked at any time by request to the contact email. Revocation is not retroactive and may make it impossible to continue providing the service.

7. Data retention

• Accounting and billing data: 10 years (Article 28 of Law 962 of 2005).
• Operational and account data: up to 30 calendar days after account termination to allow export; then deleted from active systems.
• Backups: up to 90 days after termination.
• Security and audit logs: up to 2 years for incident investigation.

8. Data subject rights

Under Colombian Law 1581 of 2012, the data subject has the right to:

• Know, update and rectify their personal data.
• Request proof of the authorization granted.
• Be informed about the use of their data.
• File complaints with the Superintendency of Industry and Commerce (SIC).
• Revoke authorization and request deletion when there is no legal or contractual duty to retain.
• Access free of charge their data.

9. How to exercise these rights

Send a communication to social@basecomputing.com.coindicating: (i) full name and ID; (ii) clear description of the right exercised and underlying facts; (iii) notification address or email; (iv) supporting documents when applicable.

Legal response times:

• Inquiries: up to 10 business days, extendable for 5 more.
• Complaints: up to 15 business days, extendable for 8 more.

10. Information security

Base Computing implements reasonable technical, administrative and organizational measures to protect personal data against loss, unauthorized access, misuse, alteration or disclosure:

• Encryption in transit (TLS 1.2 or higher) and at rest when applicable.
• Password storage with hashing functions (never in plaintext).
• Role-based access control.
• Audit logs of sensitive operations.
• Periodic backups.
• Confidentiality agreements with staff and providers.

No system is invulnerable. If we detect a security breach affecting data subjects, we will notify the affected parties and the competent authority within legal timeframes.

11. Processors and third parties

To provide the service, Base Computing relies on providers acting as processors under contractual instructions (cloud infrastructure, payment gateways, transactional email, analytics). Only the strictly necessary data is shared, under confidentiality and protection clauses equivalent to those in this Policy.

12. International transfers

Data may be processed in servers located outside Colombia, in jurisdictions with or without adequate protection per the SIC. In all cases, Base Computing adopts contractual safeguards to ensure protection equivalent to Colombian legislation.

13. Processing of minors' data

Trace is not directed at minors. Base Computing does not intentionally collect personal data from persons under 18. If a minor has provided data, their legal representatives may request deletion at the contact email.

14. Cookies

The use of cookies and similar technologies is governed by the Cookie Policy, an integral part of this Privacy Policy.

15. Changes to this Policy

This Policy may be amended at any time to reflect legal, operational or service changes. Material changes will be communicated to the data subject by email or from the Trace panel at least 15 calendar days before they take effect.

16. Contact

For any inquiry, complaint, claim or exercise of rights related to this Policy, write to social@basecomputing.com.co with the subject "Personal data".