Personal Data Processing Policy - Dessert Point Colombia S.A.S.

Title 1. Nature and Scope

1. Identification of the Data Controller

company name	DESERT POINT COLOMBIA S.A.S.
NIT	901.851.471-5
Address	Carrera 10 96-25 Of. 612
Email	dp@gausscontrol.com
Phone	+57 601 7022256

Desert Point Colombia S.A.S., hereinafter “Gauss Control,” is a commercial company duly incorporated under the laws of the Republic of Colombia that provides solutions for predicting fatigue among workers and its clients’ operators through technology platforms, Software as a Service (SaaS), software applications, and predictive models.

2. Legal Framework and Objectives of the Policy

This Policy and the other documents comprising it are governed by Article 15 of the Political Constitution of Colombia, Law 1266 of 2008, Law 1581 of 2012, Decree 1377 of 2013, and any other regulations that supplement, add to, or amend them.

Gauss Control has adopted this Personal Data Processing Policy to ensure that personal data relating to Data Subjects is processed appropriately and with the corresponding authorization, for the purposes established herein, and to guarantee the exercise of Data Subjects’ rights.

3. Scope of Application

This Policy applies to all natural persons who have or have had a relationship with Gauss Control and whose personal data is stored in our databases.

This Policy applies to personal data that is currently registered and/or may be registered in Gauss Control’s databases in connection with the provision of its services through the various technology platforms made available by Gauss Control to its clients, as well as to the personal data of its employees, clients, and suppliers, without prejudice to the provisions of any specific agreements entered into with each of them. In such cases, this Policy shall apply on a supplementary basis.
This Policy governs the procedures for the collection, management, and processing of personal data collected and/or processed by Gauss Control; the rights granted to Data Subjects; the persons or departments responsible for handling requests, inquiries, complaints, and claims before whom Data Subjects may exercise their rights to access, update, rectify, and delete their personal data and revoke their authorization; and the procedures through which Data Subjects may exercise such rights.
All of the foregoing shall apply without prejudice to any provisions specifically regulated in agreements entered into with Personal Data Subjects or their principals, in which case this Policy shall apply on a supplementary basis. Furthermore, any matter not expressly regulated by this Policy shall be governed by Law 1581 of 2012 or any legislation that replaces it.

Accordingly, our objectives are as follows:

To ensure that information is stored in accordance with appropriate security standards in order to mitigate the risk of access by unauthorized third parties, while complying with the principle of restricted access and circulation. Accordingly, Gauss Control may only manage such information with the Data Subject’s prior, express, and informed consent.
To maintain in strict confidentiality any information provided by the Data Subject to Gauss Control. At any time, the Data Subject may request access to their information from Gauss Control, and such access shall not be obstructed or denied, thereby ensuring transparency in the processing of personal data.
To inform Data Subjects of the purposes for which Gauss Control processes personal data, which must be consistent with its corporate purpose and the services that Gauss Control provides to third parties and clients. Likewise, Gauss Control shall collect only the information necessary to fulfill the purposes duly communicated to the Data Subject, limiting such collection to this legal framework and the objectives of this Policy. The information collected shall be retained in Gauss Control’s databases for a reasonable period necessary to fulfill the purpose for which it was collected.
For the processing of personal data, Gauss Control shall ensure that the Data Subject is free to decide whether to provide their information. Accordingly, the Data Subject must provide prior, express, and informed authorization before such information may be processed.
Both Gauss Control and Data Subjects must provide truthful, complete, accurate, up-to-date, verifiable, and understandable information so that the processing of such information may be carried out appropriately, thereby ensuring its transparency, accuracy, and quality.

4. Definitions

Authorization: The Data Subject’s prior, express, and informed consent to the Processing of personal data. Authorization may be granted as follows:

Verbally
In writing and/or;

Through unequivocal conduct demonstrating consent to the processing of personal data.

Authorization must be express, voluntary, and unequivocal.

Privacy Notice: A verbal or written communication addressed to the Data Subject for the purpose of fully informing them about the processing of their personal data, the Personal Data Processing Policy, the manner in which such Policy may be accessed, and the purposes for which personal data is processed.

Database: An organized set of personal data subject to Processing, whether automated or not, regardless of the form or method of its creation or organization, that allows the data to be related to one another and enables any type of data processing

Personal Data: Any information that enables the identification of a specific or identifiable natural person. Personal data may be classified as follows:

Public Data: Information classified as public by the Colombian State, including, among others, name, marital status, and profession.
Semi-Private Data: Information that, by its nature, concerns the Data Subject but is of particular interest to a specific sector, including commercial records or financial information.
Private Data: Information that concerns only the Data Subject and is not of particular interest to any other person, such as images or biometric data.
Sensitive Data: Information relating to the Data Subject that is afforded special protection because its disclosure could result in discrimination, including information concerning an individual’s health, sexual orientation, among other categories.

Personal data relating to minors, regardless of its legal classification, shall be treated as sensitive data.

Data Processor: A natural or legal person, whether public or private, that, individually or jointly with others, processes personal data on behalf of the Data Controller.

Requests, Complaints, Claims, and Inquiries: A right granted to Data Subjects, who may submit requests, complaints, claims, and inquiries to the Data Controller and/or the Data Processor.

Data Controller: A natural or legal person, whether public or private, that, individually or jointly with others, has decision-making authority over the database and/or the Processing of personal data.

Data Subject: A natural person whose personal data is subject to Processing.

Transfer: A transfer occurs when the Data Controller or Data Processor in Colombia sends information and/or personal data to a recipient located outside the country.

Transmission: The communication of personal data within or outside the territory of the Republic of Colombia for the purpose of having such data processed by the Data Processor on behalf of the Data Controller.

Processing: Any operation, set of operations, or technical procedure, whether automated or not, that enables the collection, storage, recording, organization, preparation, selection, extraction, comparison, interconnection, dissociation, communication, assignment, transfer, transmission, deletion, or any other use of personal data.

When Does Gauss Control Act as Data Controller?

Gauss Control acts as Data Controller with respect to Personal Data stored in databases that are exclusively owned and managed by Gauss Control.

When information is collected through Gauss Control’s website, forms, social media channels, customer service channels, or virtual or in-person events.
When Gauss Control enters into contractual relationships, with respect to information collected from clients and natural persons involved in such relationships. This information includes, among other data, the name of the legal representative and commercial and platform administration contacts.

When Gauss Control acts in this capacity, it shall:

At all times, Gauss Control shall guarantee the Data Subject the full and effective exercise of the right to habeas data and all other rights established under this Policy and applicable law, as well as access to the communication channels available for exercising such rights.
In order to process personal data, Gauss Control shall always request and retain the corresponding authorization granted by the Data Subject, in accordance with the conditions established by law.
Before processing personal data, Gauss Control shall inform the Data Subject of the purpose of the collection and of the rights available to them in connection with the collection, storage, and processing of their personal data.
Gauss Control shall adopt the necessary and appropriate security measures to ensure the security of information. Such measures shall include technical, administrative, and human safeguards.
Retain the information collected under the necessary security conditions to prevent its alteration, loss, unauthorized consultation, use, or fraudulent or unauthorized access.
Gauss Control shall take the necessary measures to ensure that the information provided by the Data Subject is truthful, complete, accurate, up to date, verifiable, and understandable. However, the Data Subject is also responsible for providing information that meets these requirements.
Gauss Control shall respond to Data Subjects when they submit requests, petitions, complaints, or claims concerning their personal information, including requests to update, rectify, delete, or revoke the authorization for the processing of such information. In all cases, Gauss Control shall guarantee the confidentiality of the information in accordance with subsection (e) of this section.
For the purpose of informing Data Subjects about the processing of their information, Gauss Control shall publish a Privacy Notice containing, at a minimum, Gauss Control’s full identification details, the purposes for which the information is being collected, the rights of Data Subjects, the means available to exercise such rights, and the mechanisms for accessing and reviewing this Policy.
Gauss Control shall only collect personal data that is relevant and appropriate for the purpose for which it is collected or required.
Upon request by the Data Subject, Gauss Control shall remove from its databases those Data Subjects who expressly state that they no longer wish to receive information and/or remain included in Gauss Control’s databases.

When Does Gauss Control Act as a Data Processor?

Gauss Control may also act as a Data Processor when third parties or clients provide Gauss Control with personal information relating to Data Subjects. In such cases, Gauss Control shall not own the personal databases but shall administer them pursuant to the authorization or instructions provided by the relevant third party or client. The client or third party shall remain the Data Controller and, accordingly, shall inform the Data Subject that Gauss Control acts as the Data Processor. The client shall represent and warrant to Gauss Control that it has obtained the Data Subject’s prior, express, and informed authorization.

When Gauss Control acts in this capacity, it shall:

Guarantee the Data Subject the full exercise and protection of the rights granted to them as the owner of their personal information.
Adopt the necessary security measures to safeguard the information provided by the Data Subject and prevent its alteration, loss, unauthorized consultation, use, or fraudulent or unauthorized access.
Ensure that the Data Controller on whose behalf it is acting is duly authorized to provide the personal information.
Process requests from the Data Controller within a period not exceeding five (5) business days, including requests for the updating, modification, rectification, or deletion of personal data.
The Data Processor shall handle inquiries, petitions, complaints, and claims (hereinafter, “PQR”) in accordance with the procedure established in this Policy.
- In the event of a PQR, the Data Processor shall include the notation “Claim in Process” in the database and, once the matter has been resolved, remove such notation from the database.
- In the event of a request from a public entity, administrative or judicial authority acting within the scope of its legal duties, or pursuant to a court order, the notation “Information Subject to Judicial Dispute” shall be included in the database and, once the matter has been resolved, such notation shall be removed.
- In the event of an order issued by the Superintendence of Industry and Commerce, acting as the national personal data protection authority, Gauss Control shall refrain from circulating information that is subject to an ongoing dispute.
Access to personal information shall be limited to those persons authorized under this Policy and applicable law.
If security failures are identified and there is a risk of loss of or fraudulent access to personal information, the Superintendence of Industry and Commerce shall be notified of the situation.
Comply with and ensure compliance with the instructions issued by the national personal data protection authority.

5. Purposes

Why Do We Collect Personal Information?

Gauss Control, acting as Data Controller, collects personal information for the following purposes:

Gauss Control may use personal data lawfully obtained through (i) Gauss Control devices, (ii) information provided or communicated to it in any manner by its clients, or (iii) information provided directly by Data Subjects through the use of the platforms, forms, and devices made available by Gauss Control for such purposes, as well as information obtained directly or indirectly through any other means, exclusively for the following purposes:

To perform its existing contractual relationships with clients, suppliers, and employees, including the payment and fulfillment of contractual or legal obligations;
To provide the services and/or products requested by its clients;
To provide information regarding new products or services and/or changes to existing products or services;
To evaluate the quality of services or products;
To conduct internal studies on consumption habits;
To carry out recruitment, evaluation, and employment onboarding processes;
To support internal or external audit processes;
To record employee information in Gauss Control’s databases;
To provide, share, send, or disclose personal data to Gauss Control’s affiliates, related companies, or subsidiaries, where such companies require the information solely for the purposes described herein.

Any purpose other than those listed above shall require the express authorization of the Data Subject or must otherwise be expressly permitted by the applicable regulations, including any rules that replace or amend them.

Gauss Control shall not sell, license, alter, assign, dispose of under any title, transmit, or disclose such personal data, unless:

The Data Subject has expressly authorized such action;
It is necessary to enable Gauss Control’s employees, contractors, or other agents to provide the services entrusted to them;
It is necessary to provide Gauss Control’s services and/or products in accordance with the terms agreed upon with each client;
The information is related to a merger, consolidation, acquisition, divestiture, or other restructuring process involving Gauss Control;
It is required or permitted by law. With respect to item (iv) above, as well as in all cases where Gauss Control engages third parties to process certain functions or information, Gauss Control shall include contractual provisions requiring such third parties to protect the personal information through appropriate security measures. Such third parties shall be prohibited from using the information for their own purposes or disclosing the personal information to others.

For legal and/or administrative purposes:

To conduct checks against national and international restrictive and compliance lists, including CIFIN, credit and information bureaus, the Clinton List, the Office of the Inspector General, the Office of the Comptroller General, the National Police, and DIJIN, in order to promote trust and transparency among Data Subjects, clients, suppliers, and other parties with whom Gauss Control establishes a relationship.
Where required by a judicial and/or administrative authority, Gauss Control shall provide the requested information in compliance with its legal obligations.
To support judicial and extrajudicial proceedings in which Gauss Control is involved, whether as a claimant or as a defendant.
To support internal and external audit processes.
To manage quotations, invoicing, collections, accounts receivable, orders, purchases, payment processing, and other administrative requirements of Gauss Control.
To manage and process the specific activities carried out through the platform.
Where necessary, Gauss Control may request additional information to improve the provision of its services, including for support, maintenance, updates, and to enable consumers to exercise their statutory warranty rights. Such information may also be requested at the client’s request in connection with incidents, service requests, or system failures.
Gauss Control may consult, update, process, and report client information to credit bureaus and database administrators.

Such processing of personal data shall be carried out in accordance with the provisions and guidelines established under Law 1266 of 2009.

For employment-related purposes:

To record information relating to candidates participating in the company’s recruitment processes.
To record information relating to current and former employees in the company’s databases.
- Current Employees: Information contained in résumés or employment records for the preparation of employment contracts, employment references, educational references, information necessary for enrollment in the General Social Security System, and information concerning family members where necessary, including the employee’s spouse, descendants, and/or dependent ascendants. Gauss Control may also process such information in order to comply with the company’s internal policies, including the Internal Work Regulations, internal training and development programs, the provision of information relating to job performance, whether internally or externally, and reporting obligations before competent authorities such as the National Directorate of Taxes and Customs (DIAN), the Ministry of Labor, and Superintendencies, in compliance with applicable regulations and requirements issued by national authorities.
- Former Employees: Information required for termination procedures, employment references, certification of any applicable obligations, and statistical and historical purposes.

For administrative purposes:

To control access to Gauss Control’s facilities, in which case images of the individual may be collected. Where biometric data is requested, such as fingerprints, the Data Subject must provide Gauss Control with prior, express, and informed authorization for the processing of such sensitive data.

For Statistical and/or Historical Purposes

In the event of registration or access to Gauss Control’s website, where information is collected and processed through automated mechanisms, Gauss Control may only use such information to obtain records of visitor activity and website audience metrics. Accordingly, such information may only be used to prepare reports consistent with the purposes described above and in an anonymous manner. Under no circumstances shall Gauss Control carry out operations that involve associating such information with an identified or identifiable user.
To develop or offer new products and services based on user behavior or inquiries made through Gauss Control’s website, or at the client’s request.

Where information is collected through automated means, it may be supplemented with information obtained from third parties duly authorized for such purpose in accordance with applicable law.

For any of the purposes and specific circumstances described above, once the need to Process Personal Data has ceased, such data shall be securely deleted from Gauss Control’s personal data databases.

Processing of Sensitive Data

Gauss Control shall not collect sensitive information unless strictly necessary. Sensitive data is understood as information that affects the Data Subject’s privacy and whose improper use may result in discrimination or adversely affect the Data Subject, as well as information relating to minors, such as employees’ children.

We shall only collect sensitive data in the following cases:

Social security information relating to the children of Gauss Control employees.
Physical or digital records of medical leave or incapacity certificates relating to Gauss Control employees.
Health-related procedures or situations involving a manifest medical emergency.
Biometric data and images collected through Gauss Control’s video surveillance system.

Under no circumstances shall Data Subjects be required to authorize the processing of sensitive data. Accordingly, the provision of our services is not conditional upon the disclosure of such sensitive information. Where necessary, the Data Subject shall be informed in advance and expressly requested to authorize Gauss Control to process personal data of a sensitive nature.

6. International Transmission and Transfer of Personal Information

Gauss Control may transfer and transmit Data Subjects’ personal data to strategic partners and/or affiliated companies with which the appropriate agreements shall be executed for such purposes. Where such strategic partners and/or affiliated companies are located abroad, the guidelines established under applicable regulations and the instructions issued by the Superintendence of Industry and Commerce for such purposes shall be followed.

Gauss Control may transfer or transmit personal information to companies located abroad, provided that the Data Subject has granted authorization for such purpose. Such data may be processed either by a Data Processor located abroad or transferred to a Data Controller located abroad.

Gauss Control is authorized to carry out the international transmission or transfer of Personal Information to its affiliated companies located outside the national territory.

7. Who Has Access to the Information Managed by Gauss Control?

In order to ensure compliance with the principle of restricted circulation established under applicable law, as well as the privacy and confidentiality of the information, all information collected by Gauss Control shall be accessible only to the Data Subject and Gauss Control.

Gauss Control may share information with:

Service providers supporting Gauss Control’s cloud hosting, email communications, marketing, maintenance, and technical support activities.
External auditors, including statutory auditors, and professional advisors, such as accounting and legal advisors.
Administrative or judicial authorities, where necessary to comply with Gauss Control’s legal obligations or in response to a specific request from a competent authority.
National and international affiliated companies.

The transfer or transmission of information shall be governed by the applicable regulations established for such purposes and by Section 4 of this Policy.

Any third party or interested person, provided that the Data Subject has granted prior, express, and informed authorization for such person to exercise the Data Subject’s rights on their behalf.

Such third party must present a power of attorney duly granted by the Data Subject and meeting the applicable formal requirements for this purpose. If the power of attorney is granted in Colombia, it must be duly notarized; if granted abroad, it must also include the corresponding apostille in addition to notarization by a public notary. Alternatively, the Data Subject may designate, in the authorization for the processing of personal data, the person authorized to exercise their rights.

In the event of a manifest emergency, Gauss Control may disclose personal information.

The information provided by the Data Subject shall not be made available for consultation on the Internet and/or through any other mass disclosure or communication medium, unless access is technically controlled to provide restricted access to Data Subjects.

8. Rights of Data Subjects

Data Subjects have the right to:

Access, update, rectify, request, and delete personal information to which Gauss Control has or has had access, particularly where the Data Subject determines that such information was provided and/or collected in a partial, inaccurate, incomplete, fragmented, and/or misleading manner.
Request proof of the authorization granted for the processing of their personal data, where applicable.
Request information or clarification regarding the processing of personal data provided by the Data Subject to Gauss Control.
File complaints with the Superintendence of Industry and Commerce regarding violations of applicable law and any regulations that amend it in connection with the processing of their personal data, once the procedure established in this Policy has been completed.
Any other rights established by law.

In all cases, the Data Subject may exercise these rights in accordance with Section 10 of this Policy.

9. Authorization for the Processing of Personal Data

Gauss Control undertakes to request and obtain the Data Subject’s prior, express, and informed authorization before processing their personal information.

The authorization shall include, at a minimum, the purposes of the collection, storage, and processing of personal data, the rights available to the Data Subject, the communication channels through which such rights may be exercised, and the identification of the Data Processor and/or Data Controller.

The Data Subject may grant authorization in the following ways:

In writing, through a document, form, template, printed contract, or similar means.
Verbally, in which case evidence of such authorization must be retained through a recording duly authorized for that purpose.
Through technological means, including the completion of forms or templates, participation in activities or contests, whether in person or through social media, submission of Petitions, Complaints, or Claims, data messages, or applications, where applicable.
Through clear and unequivocal conduct demonstrating authorization, provided that such conduct is express and leaves no room for doubt or misunderstanding regarding the applicable processing of personal data. Silence shall not be construed as unequivocal conduct.

Gauss Control shall ensure that the authorization remains available for subsequent consultation.

Personal data provided by the Data Subject shall be processed by Gauss Control until the Data Subject’s legal existence terminates, whether due to death or legal incapacity in the case of a natural person. In such circumstances, the Data Controller shall be informed so that the processing authorization may be terminated or, where applicable, newly granted.

In the event of Gauss Control’s dissolution and liquidation, the information stored in databases owned by Gauss Control shall be deleted and, consequently, the corresponding authorization shall cease to have effect.

Gauss Control shall not require authorization from the Data Subject in the following cases:

When the processing concerns information of a public nature.
When required by an administrative or judicial authority acting within the scope of its legal powers, or pursuant to a court order.
In cases of manifest, medical, or public health emergencies.

10. Procedure for Inquiries, Requests, Complaints, and Claims

Gauss Control shall respond to requests submitted by Data Subjects in accordance with the following procedure:

Any inquiry, petition, complaint, or claim must be submitted to Gauss Control by email at dp@gausscontrol.com, delivered in hard copy to Carrera 10 No. 96-25, Office 612, or submitted by telephone at +57 601 7022256. The request must include, at a minimum, the following information:

Name and identification of the Data Subject.
If the request is submitted by the Data Subject, they must verify their identity by presenting the corresponding identification document. If the request is submitted through an authorized representative, a power of attorney duly formalized before a public notary must be provided. If the power of attorney is issued abroad, it must be notarized and accompanied by the corresponding apostille.
A precise description of the facts or circumstances giving rise to the inquiry, petition, complaint, or claim.
Address for notifications, including a physical and/or electronic correspondence address.
Supporting documents and any relevant evidence the Data Subject wishes to provide with the request.

Regarding Inquiries

Gauss Control shall respond to inquiries submitted by the Data Subject within ten (10) business days, counted from the business day following receipt of the request. During this period, Gauss Control shall gather the information necessary to provide a complete and substantive response to the Data Subject’s request.

When Gauss Control does not have the information necessary to provide a response, it may:

Where the inquiry does not provide sufficient information regarding the relevant facts or requests, Gauss Control may request clarification or additional information from the Data Subject in order to provide a complete and substantive response. The Data Subject must respond to Gauss Control within no more than five (5) business days. During this period, the time limit applicable to Gauss Control’s response shall be suspended and shall resume once the Data Subject provides the requested information. If the Data Subject fails to respond within this period, the inquiry shall be deemed withdrawn, and Gauss Control shall issue a response based on the information available.
Inform the Data Subject that an additional period of up to five (5) business days will be required to provide a complete and substantive response to the request.

In the case of inquiries, Gauss Control shall not exceed a total response period of fifteen (15) business days.

Regarding Petitions, Complaints, and Claims

Gauss Control shall respond to petitions, complaints, and claims submitted by Data Subjects within fifteen (15) business days, counted from the business day following receipt of the communication.

When Gauss Control does not have the information necessary to provide a response, it may:

Inform the Data Subject that an additional period of up to eight (8) business days will be required to provide a response.
Where the petition, complaint, or claim does not provide sufficient information regarding the relevant facts or requests, Gauss Control may request clarification or additional information from the Data Subject in order to provide a complete and substantive response. The Data Subject must respond to Gauss Control within no more than five (5) business days. During this period, the time limit applicable to Gauss Control’s response shall be suspended and shall resume once the Data Subject provides the requested information. If the Data Subject fails to respond within this period, the request shall be deemed withdrawn, and Gauss Control shall issue a response based on the information available.

In the case of a petition, complaint, or claim, Gauss Control shall not exceed a total response period of twenty-three (23) business days.

The submission of the petition, complaint, or claim, together with the corresponding response or evidence that no response was received, shall constitute a prerequisite for filing a complaint with the Superintendence of Industry and Commerce.

11. What Security Measures Has Gauss Control Implemented?

In order to protect the Data Subjects’ rights to privacy and confidentiality, Gauss Control shall store and process information using enhanced physical, electronic, administrative, and human security measures to mitigate the risk of loss, unauthorized access, disclosure, alteration, and/or destruction of information, including, by way of example and without limitation, the following:

Retain a copy of the authorization for the processing of personal data.
Personal data is stored in electronic databases administered and safeguarded by Gauss Control.
Restrict access to information exclusively to persons authorized for such purpose.

Gauss Control cannot guarantee the absolute security of information and shall not be liable for consequences arising from technical failures or fraudulent and unauthorized access by third parties to its databases. Nevertheless, Gauss Control undertakes to use its best efforts and implement appropriate security measures to mitigate such risks.

In the event of a breach of security measures resulting in the destruction, leakage, loss, or accidental or unlawful alteration of sensitive personal data, or in its unauthorized disclosure or access, Gauss Control, acting as Data Controller and/or Data Processor, shall notify the affected Data Subjects of such breach, identifying the data affected, the potential consequences of the security incident, and the corrective or protective measures adopted.

12. Confidentiality

Gauss Control shall maintain the confidentiality and due secrecy of any personal data to which it has had access in its capacity as an Agent or Data Processor, even after the contractual relationship with the Data Controller has ended, except where disclosure is required by law or pursuant to an order issued by a competent court. In the event of any security breach that compromises the confidentiality of personal data, Gauss Control shall notify the Data Controller as soon as reasonably possible.

13. Deletion and/or Return of Data

Upon termination of the contractual relationship between the Data Controller and Gauss Control, Gauss Control shall delete or return the personal data to the Data Controller. Notwithstanding the foregoing, Gauss Control may retain such data for the period during which liabilities arising from its relationship with the Data Controller may exist. In such cases, the data shall remain blocked and shall be retained only for the minimum period necessary.

14. Effective Period of the Personal Data Processing Policy

This Personal Data Protection and Processing Policy and its related procedures shall take effect as of the date of publication and approval by Management, as evidenced in the version control table.

Gauss Control may and shall update this Policy whenever the applicable regulations are amended, repealed, supplemented, or when new provisions relating to the protection of personal data in Colombia are issued.