Privacy and personal data processing policy

Effective date: August 16, 2026

1. Identity of the data controller

COLAB AI S.A.S. (hereinafter, "COLAB"), a commercial company incorporated in Colombia, identified with Tax ID (NIT) 901819763-6, domiciled at AUTOPISTA KM 7 VÍA PIEDECUESTA COSTADO ORIENTAL VÍA MANTILLA 180 BALCONES DE RUITOQUE TORRE 2 ETAPA1 APTO 1702, Colombia. Phone: +57 314 4651563. Email: admin@colabai.tech.

2. Legal framework

This Policy is governed by the Political Constitution of Colombia, Law 1581 of 2012, Decree 1377 of 2013 and other applicable regulations on personal data protection.

3. Scope and roles

COLAB acts as DATA CONTROLLER with respect to the data of prospects, customers, website visitors and users of Colab CRM accounts. With respect to the messaging data of end customers processed on behalf of the companies that use Colab CRM (through WhatsApp Business Platform, Messenger and Instagram), COLAB acts as DATA PROCESSOR, and the client company is the DATA CONTROLLER.

4. Data we collect

• Contact data of prospects and customers: name, email address, phone number, company and content of communications.
• Account data of business users of Colab CRM: registration data, credentials, role and account settings.
• Messaging data of end customers (Meta "Platform Data"): messages and associated data processed on behalf of the client company through the WhatsApp Business Platform, Messenger and Instagram APIs. By way of example, this data may include: the WhatsApp phone number ID, the WhatsApp Business Account ID (WABA ID), the message ID, the content and metadata of the message, the profile name and the phone number of the end customer; on Messenger, the Page-Scoped ID (PSID); and on Instagram, the Instagram-Scoped ID (IGSID). In this case COLAB acts as Processor and the client company as Controller.
• Technical and usage data: IP address, device and browser type, and browsing data.
• Cookies and similar technologies (see Cookies section).

5. Purposes of processing

To provide and manage our software development services; to operate and support Colab CRM; to handle contact requests; to manage the contractual relationship; to comply with legal, accounting and tax obligations; and to improve our services. Collection is limited to data that is relevant and adequate for these purposes.

6. Use of Meta Platform Data

COLAB AI S.A.S. operates the Meta app named "colab-crm", registered as a Tech Provider independent of Meta. When COLAB processes Platform Data obtained from WhatsApp Business Platform, Messenger and Instagram on behalf of the client company, it does so solely to provide the contracted messaging service through Colab CRM. COLAB DOES NOT SELL PERSONAL DATA and complies with the Meta Platform Terms, the WhatsApp Business Messaging Policy and the other applicable policies of Meta Platforms, Inc. The use of this data is limited to what is described in this Policy. Users may request the deletion of their Platform Data at any time by following the instructions on our Data Deletion page: https://colabai.tech/en/data-deletion.

7. Transfer and transmission to third parties

We may share data with: platform providers (Meta, as provider of the WhatsApp Business Platform, Messenger and Instagram APIs); hosting and infrastructure providers; and payment processors, where applicable. These third parties process the data in accordance with the authorized purposes and adequate security measures.

8. International transfers

Some providers may be located outside Colombia. In such cases we adopt measures to ensure that the transfer or transmission complies with Colombian data protection regulations.

9. Retention

We retain data for as long as necessary to fulfill the purposes described and the applicable legal, accounting and tax obligations. Once those purposes have been fulfilled, we proceed with its deletion or anonymization.

10. Security measures

COLAB adopts reasonable administrative, technical and physical measures, in line with industry standards, to protect personal data. COLAB employs commercially reasonable efforts and does not guarantee absolute security.

11. Rights of data subjects

In accordance with Article 8 of Law 1581 of 2012, the data subject has the right to: know, update and rectify their personal data; request proof of the authorization granted; be informed about the use that has been made of their data; file complaints with the Superintendence of Industry and Commerce for violations of the law; revoke the authorization and/or request the deletion of the data; and access their personal data that has been processed, free of charge.

To specifically exercise the right of deletion (erasure) of data obtained from Meta platforms, the data subject may follow the step-by-step instructions available at https://colabai.tech/en/data-deletion or write to admin@colabai.tech.

12. Procedure and response times

Requests, inquiries and claims must be sent to admin@colabai.tech, including the data subject's identification and a description of the request. In accordance with Law 1581 of 2012: INQUIRIES will be addressed within a maximum of TEN (10) BUSINESS DAYS from the date of receipt (Article 14); CLAIMS will be addressed within a maximum of FIFTEEN (15) BUSINESS DAYS from the day following the date of receipt (Article 15). When it is not possible to respond within these terms, the data subject will be informed of the reasons for the delay and the response date. Data deletion and revocation of authorization are processed as claims, in accordance with Article 9 of Decree 1377 of 2013 and Article 15 of Law 1581 of 2012.

13. Cookies

Our website uses technical and analytics cookies for its operation and to improve the browsing experience. Users can configure their browser to accept, block or delete them.

14. Changes to this policy

Any substantial change to this Policy will be communicated in a timely manner through our website, prior to its implementation.

15. Supervisory authority

The Superintendence of Industry and Commerce (SIC), through its Deputy Office for Personal Data Protection, oversees personal data protection in Colombia (Article 19 of Law 1581 of 2012). The data subject may file complaints with the SIC once the inquiry or claim process with COLAB has been exhausted.