Courtesy translation. This English version is provided for convenience only. The legally binding text is the Spanish original, available at https://craftos.dev/politica-de-tratamiento-de-datos/.

PERSONAL DATA PROCESSING AND PROTECTION POLICY

CraftOS Platform — INTUITO COLOMBIA S.A.S. · Version 1.0 · Issued on July 9, 2026

Introduction

In compliance with the provisions of Ley 1581 de 2012 (Colombia’s Personal Data Protection Law), Decreto 1377 de 2013 (Colombian regulatory decree implementing the Personal Data Protection Law) and Decreto 886 de 2014 (Colombian decree regulating the National Database Registry), INTUITO COLOMBIA S.A.S. (hereinafter, “INTUITO COLOMBIA” or “THE COMPANY”), owner and operator of the CraftOS platform, has implemented this PERSONAL DATA PROCESSING POLICY, for the purpose of affording due processing to the personal information collected through CraftOS, whether directly or by means of the applications (hereinafter, “Apps”) created and published by the users of the Platform. This Policy likewise contemplates the handling of petitions, inquiries and complaints related to the processing of this type of information.

This Personal Data Processing Policy is addressed to all natural persons who have or have had any relationship with INTUITO COLOMBIA S.A.S. or with the CraftOS platform, and whose personal data are contained in its databases, including users who create applications (“Builders”), those who acquire or use them (“End Users”) and, where applicable, third parties whose data are uploaded into such applications.

Given that CraftOS allows its users to create multiple and highly diverse applications, some of which may process personal data and even sensitive data, this Policy is not limited to any single particular application, but rather governs the general operation of the Platform as a technology provider and operator of its application Marketplace.

Identification

Company: Intuito Colombia S.A.S.
NIT: 901.664.945-2
Address: Calle 19 No. 5-51, Oficina 506, Bogotá D.C. – Colombia
Email: soporte@craftos.dev
Website: www.craftos.dev
Product / Platform: CraftOS

Legal Framework

This personal data Processing policy is prepared in accordance with the provisions of the Political Constitution, article 15, Ley 1581 de 2012 (Colombia’s Personal Data Protection Law), Decreto 1377 de 2013 (Colombian regulatory decree implementing the Personal Data Protection Law), Decreto 886 de 2014 (Colombian decree regulating the National Database Registry), Decreto 1074 de 2015 (Colombia’s Single Regulatory Decree for the Commerce, Industry and Tourism Sector), the Circular Única de la Superintendencia de Industria y Comercio (Single Circular of the Colombian Superintendence of Industry and Commerce), Title V, and other complementary provisions that may modify, add to or supplement them, which shall be applied by INTUITO COLOMBIA with respect to the collection, storage, use, circulation, deletion and all those activities that constitute Processing of personal data.

The following are the guiding principles for the Processing of personal data that INTUITO COLOMBIA, as an entity respectful of the law, shall abide by: (i) Principle of Legality, (ii) Principle of Purpose, (iii) Principle of Freedom, (iv) Principle of Truthfulness or Quality, (v) Principle of Transparency, (vi) Principle of Restricted Access and Circulation, (vii) Principle of Temporality of the data, (viii) Principle of Security and (ix) Principle of Confidentiality.

Definitions

For purposes of the interpretation and application of this policy, the following definitions, among others, shall be taken into account:

• Authorization: prior, express and informed consent of the Data Subject to carry out the Processing of personal data.
• Privacy notice: communication addressed to the Data Subject whereby the Data Subject is informed of the existence of this Policy, the manner of accessing it and the purposes of the Processing intended to be given to their personal data.
• Database: organized set of personal data that is subject to Processing.
• Personal data: any information linked to or that may be associated with one or several determined or determinable natural persons.
• Sensitive data: that which affects the privacy of the Data Subject or whose improper use may generate discrimination against them, such as racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions or social or human rights organizations, as well as data relating to health, sexual life and biometric data.
• Data Processor: natural or legal person, public or private, that by itself or in association with others carries out the Processing of personal data on behalf of the Data Controller.
• Data Controller: natural or legal person, public or private, that by itself or in association with others decides on the database and/or the Processing of the data.
• Data Subject: natural person whose personal data are subject to Processing.
• Transfer: takes place when the Data Controller and/or Data Processor of personal data, located in Colombia, sends the information to a recipient that is in turn a Data Controller and is located within or outside the country.
• Transmission: Processing of personal data that entails their communication within or outside Colombian territory, where its purpose is the carrying out of Processing by the Data Processor on behalf of the Data Controller.
• Processing: any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
• Deletion: elimination of the personal data, in whole or in part, from the records, files, databases or Processing carried out by the Data Controller or Data Processor.
• CraftOS or the Platform: the SaaS technological platform owned by INTUITO COLOMBIA S.A.S., which allows Applications to be created, executed and published by means of artificial intelligence, without the need for programming.
• Builder: user of CraftOS who, through natural language, describes and creates an Application, and who may choose to use it privately or to publish it on the Marketplace so that other users may acquire it.
• End User: person who acquires and/or uses an Application published by a Builder on the CraftOS Marketplace.
• Application or App: software generated through CraftOS by a Builder, composed of an interface and operating logic defined by means of natural language instructions.
• Marketplace: space within the Platform in which Builders may publish their Applications so that they may be acquired and used by End Users.
• Deletion button: functionality mandatorily incorporated into every Application created with CraftOS, which allows the permanent deletion of the information stored in the Platform’s technological infrastructure.

Purpose

This document sets forth the Personal Data Processing Policy of INTUITO COLOMBIA S.A.S., the scope of which shall be the application to all databases in which personal information is stored and subject to Processing by the company, hereinafter INTUITO COLOMBIA or THE COMPANY, within the framework of the operation of the CraftOS platform.

INTUITO COLOMBIA understands data protection to mean all those measures adopted at the physical, technical and legal level to ensure that the information of the Data Subjects is secure against any attack or attempted access by unauthorized persons, as well as that its use and retention are appropriate.

Actors and Roles with Respect to the Processing of Personal Data in CraftOS

Various actors take part in the operation of CraftOS whose role with respect to the Processing of personal data may vary according to the type of data concerned: (i) INTUITO COLOMBIA, as provider of the technological platform; (ii) the Builder, the user who creates an Application through CraftOS and who may publish it on the Marketplace so that other users (End Users) may acquire or use it; and (iii) the End User. This distinction is relevant for purposes of this Policy, inasmuch as it determines whether INTUITO COLOMBIA acts as Data Controller or as Data Processor.

As Data Controller

With respect to the personal data necessary for the administration of the Platform—Builder and End User accounts, authentication, billing, support, operation of the Marketplace and direct commercial relationships—, INTUITO COLOMBIA acts as Data Controller, since it is the party that decides on the purpose and the means of such Processing.

As Data Processor

With respect to the information that is uploaded, generated or processed through the Applications created by the Builders, INTUITO COLOMBIA acts as Data Processor, given that it is the Builder who decides the purpose and the use to be given to such information within its Application.

On this point, it is important to clarify that Builders do not have access to the source code of their Applications, to the underlying database, or to the files or documents uploaded by their End Users; such access resides exclusively in the technological infrastructure (cloud) administered by INTUITO COLOMBIA. Consequently, although the Builder defines the purpose and the type of information that its Application shall request—and is, to that extent, Data Controller with respect to such purpose—, it is INTUITO COLOMBIA which, through the Application generator, automatically and mandatorily incorporates into each Application the technical mechanisms necessary for compliance with the applicable data protection regulations, such as the notices or authorization messages that are displayed at the time documents are uploaded and the data deletion functionality. These mechanisms may not be removed, deactivated or modified by the Builder through instructions to the Application generator.

Databases

The databases with respect to which INTUITO COLOMBIA carries out the Processing of personal information within the framework of the operation of CraftOS are described below:

Builders database

Description: corresponds to the information of the natural persons who register in CraftOS to create and, where applicable, publish Applications.
Content: name, type and number of identification document, email address, telephone number, billing and payment information, IP address, and any other information necessary for the creation and administration of the account.
Purpose: to enable registration and authentication on the Platform, the creation and publication of Applications, billing and collection for the use of CraftOS and of the Applications published on the Marketplace, technical support, and compliance with legal and contractual obligations.
Role of INTUITO COLOMBIA: Data Controller.

Database of End Users of the Marketplace Applications

Description: corresponds to the information of the natural persons who acquire or use an Application published by a Builder on the Marketplace.

Content: account and authentication data in the Application (name, email address, position or role, among others) and, additionally, the information that each Application is designed to receive, store or process according to its particular purpose, which may include, among others, identification documents, documents of representation, administrative or judicial filings, or other personal information that the Builder has defined to receive through its Application, and which in some cases may correspond to sensitive data.
Purpose: to enable access to and use of the acquired Application, and the specific purposes that each Builder has defined and disclosed to its End Users in the privacy notice of its own Application.
Role of INTUITO COLOMBIA: Data Processor with respect to the information inherent to the operation of each Application; Data Controller with respect to the account and Platform access data.

Database of employees, contractors and suppliers

Description: corresponds to the information of natural persons linked to INTUITO COLOMBIA under an employment or contractual relationship, as well as of applicants for vacant positions and suppliers of the company.
Content: name, identification number, contact details, contractual, employment, academic and banking information and, where applicable, data of affiliation to the Social Security System.
Purpose: management of the employment or contractual relationship, payment of payroll and professional fees, compliance with legal, tax and social security obligations, and internal administrative management.
Role of INTUITO COLOMBIA: Data Controller.

Sensitive Databases

Given that some Applications created in CraftOS may process sensitive data, INTUITO COLOMBIA and the respective Builders, according to their role, shall:

• Inform the Data Subject that, since the data are sensitive, he or she is not obliged to authorize their Processing.
• Inform the Data Subject which of the data are sensitive and the purpose of their Processing.
• Refrain from conditioning any activity upon the Data Subject providing sensitive data.
• Obtain the corresponding authorization in a prior, express and informed manner, except in the cases excepted by law (for example, when the Processing is necessary for the recognition, exercise or defense of a right in judicial proceedings, or when it is carried out by a public entity in the exercise of its legal functions).

Registration of the Databases

In accordance with Decreto 886 de 2014 (Colombian decree regulating the National Database Registry), Data Controllers that are not excepted by the applicable regulations by reason of their business size and of the not exclusively internal nature of the Processing they carry out, must register their databases in the Registro Nacional de Bases de Datos (RNBD) (National Database Registry) administered by the Superintendencia de Industria y Comercio (Colombia’s Superintendence of Industry and Commerce). INTUITO COLOMBIA shall periodically assess whether, in accordance with its business size and with the nature of the Processing it carries out through CraftOS, it is obliged to make such registration, and shall proceed to make it within the legal terms when applicable.

Authorization of the Data Subject for the Processing of Personal Data

INTUITO COLOMBIA has adopted procedures to request from Builders and End Users, no later than at the time of the collection of their personal data, their authorization for the Processing thereof, informing them of the specific purposes for which their consent is obtained.

Upon creating an account in CraftOS, the Builder or the End User authorizes INTUITO COLOMBIA to collect, store, use and circulate his or her personal data for the purposes described in this Policy and in the terms and conditions of use of the Platform. With respect to the personal data of third parties that are uploaded, processed or stored through an Application, the Builder is responsible for defining the purpose and the lawfulness of such Processing; however, the capture of the corresponding authorization from such Data Subjects is carried out through the notices and consent mechanisms that INTUITO COLOMBIA incorporates automatically and mandatorily in each Application through the CraftOS generator (for example, authorization messages that are displayed at the time of uploading a document), which may not be omitted, removed or modified by the Builder. The foregoing does not exempt the Builder from having a lawful basis for the Processing it carries out through its Application, nor from the additional obligations that, by reason of its activity, may be applicable to it (for example, when acting in the exercise of public functions).

The authorization granted by the Data Subject complies with the requirements demanded by the applicable current legislation, when it is expressed: in writing, orally, or by unequivocal conduct of the Data Subject that reasonably allows the conclusion that he or she granted it. In no event shall the silence of the Data Subject be deemed by INTUITO COLOMBIA as unequivocal conduct.

INTUITO COLOMBIA has established the email address soporte@craftos.dev as the channel through which the Data Subject may, at any time, request the deletion of his or her personal data and/or revoke the authorization granted for their Processing, without prejudice to the deletion functionality (delete button) available directly in each Application.

Security Measures and Regulatory Compliance

CraftOS collects and stores its users’ information on servers of recognized cloud infrastructure providers, which may only be accessed by means of a username and password. The stored information complies with the security standards in force.

INTUITO COLOMBIA has in place a security protocol, followed by the entire work team, so that, when the Data Subject requests his or her data, such data shall be delivered or deleted as required, including through the deletion button available in each Application.

New members of INTUITO COLOMBIA’s work team are trained upon their entry on the security rules applicable to the data managed in CraftOS, for the appropriate use of such information.

INTUITO COLOMBIA has designated a personal data protection area responsible for ensuring compliance with the regulations in force, maintaining a record of the work team’s training, and overseeing the established security procedures. Said area may be contacted at the email address soporte@craftos.dev.

Use and Purpose of the Processing of Personal Data

INTUITO COLOMBIA collects, records, stores, and uses the Data Subjects’ personal data for its own use, for the purposes for which they were requested or at the requirement of public entities. The personal data processed by INTUITO COLOMBIA in its capacity as Data Controller shall be used, among others, to:

• Create, manage, and authenticate the accounts of Builders and End Users.
• Enable the use of the Platform’s functionalities, including the generation of Applications by means of artificial intelligence.
• Operate the Marketplace, including the publication, acquisition, and charging of the Applications.
• Process payments and manage the billing of CraftOS services.
• Provide technical support and customer service.
• Send transactional and security communications and, upon prior authorization, commercial communications.
• Detect, prevent, and investigate fraud, misuse, or security incidents.
• Support internal and external audit processes and respond to requirements from competent authorities.
• Comply with legal, accounting, tax, and regulatory obligations applicable to INTUITO COLOMBIA.

The personal data that a Builder collects, stores, or processes through its Application shall be used exclusively for the purposes defined by such Builder and disclosed to its End Users or to the third-party owners of the information, in the privacy notice of each Application. INTUITO COLOMBIA, as Data Processor, shall process such information solely in accordance with the Builder’s instructions and for the provision of the Platform’s technological service, without using it for any other purposes or disclosing it to unauthorized third parties.

The personal data shall be used by INTUITO COLOMBIA only for the purposes set forth herein; therefore, INTUITO COLOMBIA shall not sell, license, transmit, or disclose the Data Subjects’ personal data, unless the Data Subject expressly authorizes it, such action is permitted by law, or the information is related to a merger, acquisition, or other restructuring process of THE COMPANY.

Once the need for the Processing of the personal data ceases, such data shall be deleted from INTUITO COLOMBIA’s databases in a secure manner, unless its retention is necessary or mandatory in compliance with the applicable regulations or with any previously acquired obligation.

Data Processing in the Artificial Intelligence Application Generator

Given that the core functionality of CraftOS consists of generating Applications from instructions in natural language, INTUITO COLOMBIA specifies below how the data involved in this process are treated:

• The instructions, descriptions, and other content that a Builder enters in order to generate an Application (“prompts”) are used to produce the interface and the operating logic of such Application, and to render the contracted service.
• INTUITO COLOMBIA does not use the identifiable personal data of the Data Subjects, nor the specific content of a Builder’s Applications, to train general-purpose artificial intelligence models that benefit other Builders, except with the express authorization of the corresponding Builder.
• Where it is necessary to resort to external artificial intelligence model providers in order to generate or run an Application, such providers shall process the information solely as a technical pass-through in order to produce the requested result, and shall be subject to confidentiality and data protection obligations equivalent to those established herein.
• INTUITO COLOMBIA may use anonymized or aggregated information, which does not allow a Data Subject to be identified, for purposes of improving the operation, security, and quality of the Platform.

This section does not release the Builder from its duty not to enter into the prompts or into the Applications personal or sensitive data of third parties without holding the corresponding authorization, in accordance with the provisions of the section “Duties and Responsibilities of the Builder” of this Policy.

Cookies and Similar Technologies

The CraftOS website and Platform use cookies and similar technologies to operate, secure, and analyze the service. These are classified as follows:

• Strictly necessary cookies: they enable essential functions such as login, session routing, and fraud prevention; they do not require prior authorization.
• Analytics and performance cookies: these allow measuring the use of features, diagnosing errors and improving the service.
• Functional cookies: these remember user preferences, such as language or interface settings.

The user may manage or disable non-essential cookies through their browser settings. INTUITO COLOMBIA does not sell or share Data Subjects’ personal information for third-party behavioral advertising purposes.

Privacy Notice

INTUITO COLOMBIA S.A.S. declares that it protects the personal data provided by Data Subjects pursuant to the provisions of Ley 1581 de 2012 (Colombia’s Personal Data Protection Law) and informs them that their personal data shall be used on the terms set forth in the authorization granted and described in this Policy, as well as, where applicable, in the specific privacy notice of each Application published on the Marketplace.

The Data Controller and/or Data Processor shall be INTUITO COLOMBIA S.A.S. or the corresponding Builder, according to the role applicable to each of them in accordance with the provisions of the section “Actors and Roles with respect to the Processing of Personal Data in CraftOS” of this Policy. The Data Subject may access this Policy through the Platform and the CraftOS website, at any time and free of charge.

Revocation of the Authorization and/or Deletion of Data

The Data Subject has the right, at any time, to request the deletion (erasure) of their personal data when they consider that such data is not being processed in accordance with the principles, duties and obligations set forth in Ley 1581 de 2012; when the data is no longer necessary or relevant for the purpose for which it was collected; or when the period necessary for the fulfillment of such purposes has elapsed.

Such deletion entails the total or partial erasure of the personal information, in accordance with the Data Subject’s request, from the records, files, databases or Processing operations carried out by INTUITO COLOMBIA or by the corresponding Builder. This right may be denied when the Data Subject has a legal or contractual duty to remain in the database, when the erasure would hinder judicial or administrative proceedings, or when the data is necessary to protect legally protected interests or to comply with a legal obligation.

Privacy by design: the deletion button

As a privacy by design and by default measure, every Application created with CraftOS mandatorily incorporates a deletion button that allows the permanent erasure of the information stored in the Platform’s technological infrastructure. The CraftOS Application generator does not allow the creation or publication of Applications that omit this functionality.

Upon activation of the deletion button, the corresponding information is erased from CraftOS’s servers and systems and ceases to be available within the Platform, except for: (i) backup copies generated beforehand, which shall be purged within the ordinary technical rotation periods; (ii) information that must be retained by virtue of a legal, accounting, tax or regulatory obligation applicable to INTUITO COLOMBIA; and (iii) information subject to a request from a competent judicial or administrative authority.

This functionality transfers to the Builder and/or the End User the operational decision regarding the retention or deletion of their Application’s information. Nevertheless, its use does not release the Builder —nor, where applicable, the entity or organization it represents— from compliance with its own legal obligations regarding documentary retention or archiving (for example, the archival obligations governing public entities pursuant to Ley 594 de 1997 (Colombia’s General Archives Law)). It is incumbent upon each Builder to assess, before deleting information through this functionality, whether it has a legal duty to retain it.

Rights of the Data Subject

The Data Subject of the personal data shall have the following rights:

1. To know, update and rectify their personal data before INTUITO COLOMBIA or before the respective Builder, depending on which one acts as Data Controller. This right may be exercised, among others, with respect to partial, inaccurate, incomplete, fragmented or misleading data, or data whose Processing is expressly prohibited or has not been authorized.
2. To request proof of the authorization granted, except where it is expressly exempted as a requirement for Processing.
3. To be informed, upon request, as to the use that has been made of their personal data.
4. To file complaints before the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio) for violations of the provisions of Ley 1581 de 2012 and any other rules that amend, supplement or complement it.
5. To revoke the authorization and/or request the deletion of the data when the constitutional and legal principles, rights and guarantees are not respected in the Processing.
6. To access, free of charge, their personal data that has been subject to Processing.
7. To refrain from providing sensitive data.
8. To directly use the deletion button available in each Application, where applicable, as an expedient mechanism for the deletion of the stored information.

Procedure for the Exercise of the Data Subject’s Rights

The rights of the Data Subjects may be exercised before INTUITO COLOMBIA by: (i) the Data Subject, who shall sufficiently prove their identity by the means available to them; (ii) the Data Subject’s successors in interest, who shall prove such status; and (iii) the Data Subject’s representative and/or attorney-in-fact, upon prior accreditation of such representation or power of attorney.

Protection of Personal Data of Minors and Adolescents

In accordance with the provisions of Ley Estatutaria 1581 de 2012 (Colombia’s Personal Data Protection Statutory Law), Decreto Reglamentario 1377 de 2013 (Colombia’s implementing decree on personal data protection) and Sentencia C-748 de 2011 (Judgment C-748 of 2011 of the Colombian Constitutional Court), CraftOS is not directed to persons under 18 years of age and does not intentionally collect personal data of minors as Builders or as holders of Platform accounts. In the event that an Application created by a Builder should involve the Processing of data of children or adolescents, the respective Builder shall ensure that such Processing responds to the best interests of the minors, respects their fundamental rights and has the prior, express and informed authorization of their fathers, mothers or legal representatives. If INTUITO COLOMBIA becomes aware that data of a minor has been collected without the corresponding authorizations, it shall proceed to delete such data diligently.

Procedure for Inquiries

Data Subjects, their successors in title, representatives or attorneys-in-fact may inquire about the Data Subject’s personal information contained in INTUITO COLOMBIA’s databases. The inquiry shall be submitted through the enabled channels, and shall be addressed within a maximum term of ten (10) business days counted as from the date of its receipt. When it is not possible to address the inquiry within such term, the interested party shall be informed before its expiration, stating the reasons for the delay and the date on which the inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the first term. Data Subjects may consult their personal data free of charge at least once each calendar month.

Procedure for Complaints

Data Subjects who consider that the information contained in INTUITO COLOMBIA’s databases must be corrected, updated or deleted, or who become aware of an alleged breach of the law, may file a complaint by means of a written request addressed to INTUITO COLOMBIA, including the identification of the Data Subject, a description of the facts, the contact address and the documents to be relied upon, attaching a copy of the identification document.

If the complaint is incomplete, the interested party shall be required, within the five (5) business days following its receipt, to cure the defects; once two (2) months have elapsed without the applicant providing the required information, the complaint shall be deemed withdrawn. Upon receipt of the complete complaint, a notation reading “complaint in process” shall be included in the database within the following two (2) business days, and shall remain until the complaint is decided. The maximum term to address it shall be fifteen (15) business days counted as from the day following its receipt, extendable for up to eight (8) additional business days when the interested party is so informed.

Enabled Channels

The rights of Data Subjects may be exercised, free of charge, through:

• Email: soporte@craftos.dev
• The request forms or functionalities available within the Platform, including the deletion button available in each Application.
• Written communication addressed to: Calle 19 No. 5-51, Oficina 506, Bogotá D.C. – Colombia.

When the request concerns personal data processed by a Builder within the framework of a specific Application (that is, data with respect to which the Builder acts as Data Controller), INTUITO COLOMBIA, in its capacity as Data Processor, shall forward the request to the corresponding Builder and shall provide reasonable cooperation for its timely handling, without prejudice to the Data Subject’s duty to address the Builder directly when doing so is more expedient.

Duties of Intuito Colombia as Data Controller and Data Processor of Personal Data

As Data Controller

The following are duties of INTUITO COLOMBIA, without prejudice to the other provisions set forth in the law:

1. To guarantee to the Data Subject, at all times, the full and effective exercise of the right of habeas data.
2. To request and retain a copy of the respective authorization granted by the Data Subject.
3. To duly inform the Data Subject of the purpose of the collection and of the rights afforded to the Data Subject by virtue of the authorization granted.
4. To keep the information under the security conditions necessary to prevent its alteration, loss, or unauthorized or fraudulent consultation, use or access.
5. To guarantee that the information is truthful, complete, accurate, updated, verifiable and understandable.
6. To rectify the information when it is incorrect and to communicate the relevant matters.
7. To process the inquiries and complaints filed under the terms set forth by law.
8. To inform the data protection authority when breaches of security codes occur and risks exist in the administration of the Data Subjects’ information.
9. To comply with the requirements and instructions issued by the Superintendencia de Industria y Comercio (Colombia’s Superintendence of Industry and Commerce) on the matter.
10. To register the applicable databases before the Registro Nacional de Bases de Datos (Colombia’s National Database Registry), in the event that current regulations so require according to the business size and the type of Processing carried out by INTUITO COLOMBIA.

As Data Processor

When INTUITO COLOMBIA acts as Data Processor with respect to the information processed by the Builders’ Applications, it shall:

1. Process personal data solely in accordance with the instructions of the Builder acting as Data Controller, and for the purpose of providing the technological service of the Platform.
2. Guarantee the reserve and confidentiality of the information, even after the termination of its relationship with the Builder.
3. To refrain from circulating or disclosing the information to unauthorized third parties, except upon requirement of a competent authority.
4. To retain the information with the necessary security measures for as long as the Builder’s instruction remains in effect or until the Builder activates the deletion button.
5. To inform the Builder of any security incidents that may affect the personal data it processes on its own account.
6. To incorporate, through the Application generator, the technical notice, authorization and data deletion mechanisms applicable to each Application, and such mechanisms may not be removed, deactivated or modified upon the Builder’s instruction.

Duties and Responsibilities of the Builder

The Builder who creates an Application on CraftOS, especially where such Application collects, stores or processes personal data of End Users or of third parties, is the party that defines the purpose and use to be given to such information and, to that extent, assumes the following duties as Data Controller with respect to such purpose:

1. To define and communicate to its End Users, clearly and sufficiently, the purpose for which its Application requests certain information.
2. To have a lawful basis for the Processing of the personal data collected by its Application (the Data Subject’s authorization or another basis provided for in Ley 1581 de 2012 (Colombia’s Personal Data Protection Law)), without prejudice to the technical mechanisms for capturing such authorization being automatically incorporated by CraftOS into the Application.
3. To comply with the sector-specific regulations applicable to it by reason of its activity, entity or organization (for example, the records management, disciplinary or confidentiality obligations applicable to public entities).
4. To refrain from requesting INTUITO COLOMBIA to remove, deactivate or modify the authorization notices, privacy notice or data deletion functionality that the Application generator incorporates on a mandatory basis; in any event, such instructions shall not be executed by the Platform.
5. To address, directly or with the collaboration of INTUITO COLOMBIA in its capacity as Data Processor, the requests of Data Subjects relating to the personal data processed through its Application.
6. To hold INTUITO COLOMBIA harmless against any claim arising from the purpose or the lawfulness of the Processing defined by the Builder for its Application.

Information Security Measures Applied to the Processing of Databases

INTUITO COLOMBIA shall adopt the technical, human and administrative measures that are necessary to afford security to the records, preventing their alteration, loss, or unauthorized or fraudulent consultation, use or access. Personnel carrying out the Processing of personal data shall execute the established protocols in order to guarantee the security of the information.

To this end, INTUITO COLOMBIA maintains security and access protocols for its information, storage and processing systems, including physical and logical security risk control measures, as well as encryption of information in transit and, where technically feasible, at rest. The system is continuously monitored through vulnerability analyses. Access to the various databases is restricted, including for employees and collaborators, by means of role-based access control.

All INTUITO COLOMBIA personnel execute confidentiality clauses in their contracts and are committed to the proper handling of the databases, in accordance with the guidelines on the Processing of information established by law, an obligation that remains in force even after the termination of their relationship with THE COMPANY.

INTUITO COLOMBIA has implemented the security mechanisms available in the market that are consistent with CraftOS and its Applications. Notwithstanding, despite the due diligence adopted, INTUITO COLOMBIA shall not be liable for the consequences arising from the improper or fraudulent access by third parties to the databases, or from technical failures beyond its control. Any security incident detected shall be reported immediately to the competent authorities and, where applicable, to the affected Data Subjects and to the respective Builder.

Party Responsible for Handling Petitions, Inquiries and Claims

Responsibility for the Processing of personal data at INTUITO COLOMBIA rests with all of its employees, who shall adopt the rules and procedures for the application of and compliance with the regulation, given their status as custodians of the personal information contained in THE COMPANY’s information systems.

INTUITO COLOMBIA has designated its Personal Data Protection area as responsible for compliance with this Policy, which shall be available to resolve petitions, inquiries and claims, and to carry out any update, rectification, deletion and revocation of authorization for the handling of personal data, through the channels made available for such purpose.

Area in charge: Personal Data Protection Area of Intuito Colombia S.A.S.
Email: soporte@craftos.dev
Address: Calle 19 No. 5-51, Oficina 506, Bogotá D.C. – Colombia

International Transfer and Transmission of Personal Data

INTUITO COLOMBIA S.A.S. may carry out the transfer and transmission of the Data Subjects’ personal data. To that end, it shall take the necessary measures to ensure that third parties are aware of and undertake to comply with this Policy, on the understanding that the personal information they receive may only be used for matters directly related to INTUITO COLOMBIA, and solely for the duration of such relationship, and may not be used or applied for any different purpose. International transfers of personal data shall be subject to the provisions of Article 26 of Ley 1581 de 2012 (Colombia’s Personal Data Protection Law).

By accepting this Policy, the Data Subject expressly authorizes the transfer and transmission of their personal information for all relationships that may be established with INTUITO COLOMBIA. For the provision of the service, INTUITO COLOMBIA may host the information on servers located outside Colombian territory, through cloud infrastructure providers.

With respect to any personal data that a Builder delivers, shares, transmits, or transfers to INTUITO COLOMBIA by virtue of the relationship existing with its End Users or with third parties, the Builder warrants to INTUITO COLOMBIA that it has obtained the prior and express authorization of the Data Subject of such personal data so that the same may be processed by INTUITO COLOMBIA for the specific purposes for which they were delivered, and undertakes to hold INTUITO COLOMBIA harmless against any lawsuit, claim, or legal action arising from the Processing of personal data supplied by the Builder without such authorization.

Amendments to the Privacy and Data Processing Policy

INTUITO COLOMBIA reserves the right to amend this Policy as required for its operation and regulatory compliance. Nevertheless, in the event of substantial changes to its content, the latest version shall be made known through physical or electronic means, indicating the date of its entry into force.

Date of Entry into Force

This Personal Data Processing Policy was issued in Bogotá D.C. and enters into force as of July 9, 2026. Any change made to this Policy shall be reported through the Platform and the website www.craftos.dev.