Privacy policy and personal data processing

1. Data controllers

The Data Controllers for the personal data collected through Naia Finance are:

ID Technology SAS

Tax ID (NIT) 900.299.757-5
Domicile: Medellín, Antioquia, Colombia
Role: responsible for the development and technical operation of the platform

Grow Finance Strategy S.A.S.

Tax ID (NIT) 902.035.289-4
Domicile: Medellín, Colombia
Role: responsible for data processing within the financial consulting services included in the plans

Both companies act as joint data controllers under the Joint Venture formalized between them. For practical purposes, any request related to data processing can be sent to either company through:

Single contact email: privacidad@naiafinance.com

2. Data we collect

2.1 Data you provide directly

Identification data: full name, ID number
Contact data: email address, mobile phone number (WhatsApp)
WhatsApp Business conversation history needed to process your requests — not stored beyond the retention period defined in section 6
Company data: name, Tax ID (NIT), economic sector, city
Your company's financial data: transactions, income, expenses, categories, goals and any other information you voluntarily enter into the Service
Payment data: processed by Wompi/Bancolombia — Naia does not store card numbers or full bank details

2.2 Data collected automatically

Usage data: features used, access frequency, interactions
Technical data: IP address, browser type, operating system, device identifiers
Session data: authentication tokens, platform preferences

2.3 Third-party data

Information from integrations authorized by the user (for example, Excel files uploaded by the user)

3. Purposes of processing

We process your data for the following purposes:

a) Contractual (legal basis: performance of the contract)

Create and manage your user account
Provide the contracted Service (dashboard, AI, consulting)
Process payments and issue electronic invoices
Provide technical support and customer service

b) Legal (legal basis: compliance with a legal obligation)

Comply with tax and accounting obligations
Respond to requests from competent authorities
Keep records for the legally required periods

c) Legitimate interest (legal basis: Naia's legitimate interest)

Improve the Service and develop new features
Prevent fraud and keep the platform secure
Aggregated and anonymized statistical analysis

Sending commercial communications, Service updates and educational content on finance for SMEs
Using your success story (anonymized or with your express authorization) in marketing materials

4. Data subjects' rights (ARCO rights)

Under Law 1581 of 2012, you have the right to:

Access: know which of your data we process and how
Rectify: correct inaccurate or incomplete data
Cancel: request the deletion of your data when it is no longer needed for the purpose it was collected for
Object: object to the processing of your data for specific purposes, in particular commercial communications
Revoke: withdraw the consent you gave at any time, without retroactive effect
Portability: request your data in a structured, readable format

To exercise these rights, send your request to privacidad@naiafinance.com with your full name, ID number, a description of the right you want to exercise and a copy of your ID document.

Response time: 10 business days to confirm receipt and 15 additional business days to give a substantive response, extendable under Decree 1377 of 2013.

If you believe your request was not handled properly, you can file a complaint with the Superintendence of Industry and Commerce (SIC) of Colombia: www.sic.gov.co

5. Data transfer and transmission

5.1 Data processors (transmission)

We share data with providers that act as Data Processors under Naia's instructions and with contractual confidentiality and security obligations:

Microsoft Azure: cloud infrastructure and data storage, servers located in Colombia or the nearest available region
Anthropic (Claude API): AI query processing — the data sent is anonymized or pseudonymized as far as possible
Meta Platforms (WhatsApp Business API): messaging channel
Wompi / Bancolombia: payment processing
Email providers for transactional communications

5.2 Third-party recipients (transfer)

We do not sell or assign your personal data to third parties for their own commercial purposes. We may share data with third parties only when:

You have given your express consent
It is necessary to comply with legal obligations
It is necessary in the context of a merger, acquisition or corporate reorganization, with appropriate confidentiality guarantees

Some of our providers (Microsoft, Anthropic, Meta) process data outside Colombia. In these cases, we contractually require them to meet protection standards equivalent to those of Colombian law. For users in the European Union or California (USA), we apply the additional safeguards required by the GDPR and the CCPA respectively.

6. Data retention

We keep your personal data for:

The term of your active subscription
5 additional years after cancellation for legal and accounting obligations (Colombian Commercial Code, art. 60)
As long as needed to resolve pending disputes or meet legal obligations

Your company's financial data (transactions, KPIs) may be kept for up to 10 years under tax obligations (Art. 632 of the Colombian Tax Code).

7. Information security

We implement appropriate technical and organizational measures to protect your data, including:

Encryption in transit: TLS 1.2 or higher on all communications
Encryption at rest: data stored in Azure with AES-256 encryption
Access control: OTP + JWT authentication, roles and permissions per user
Data isolation: multi-tenant architecture with Row Level Security (RLS) in PostgreSQL — no customer can access another customer's data
Auditing: logging of access and critical operations
Monitoring: Azure Monitor and Application Insights for anomaly detection
Periodic security reviews

In the event of a security breach affecting your data, we will notify you within 72 hours of detecting it, as required by current regulations.

8. Cookies and tracking technologies

The naiafinance.com website may use:

Strictly necessary cookies: for the site to work (session, language preferences). They do not require consent.
Analytics cookies: Google Analytics / Hotjar to understand how the site is used. They are enabled only with your consent.
No third-party targeted advertising cookies.

You can manage or disable cookies from your browser settings without affecting how the application works.

9. Minors

The Service is not directed at people under 18. We do not knowingly collect data from minors. If you become aware that a minor has provided us with data without parental consent, contact us at privacidad@naiafinance.com so we can delete it.

10. Additional rights for California users (CCPA)

If you are a resident of the state of California (USA) and use the Service, you have additional rights under the California Consumer Privacy Act (CCPA): the right to know, the right to delete, the right to non-discrimination and the right to opt out of the sale of personal data. Naia does not sell personal data. To exercise these rights: privacidad@naiafinance.com

Email: privacidad@naiafinance.com
Address: Medellín, Antioquia, Colombia
Hours: Monday to Friday, 8:00 a.m. – 6:00 p.m. (Colombia time)

If you do not get a satisfactory response, you can turn to:

Superintendence of Industry and Commerce (SIC)

Carrera 13 # 27-00, Bogotá, Colombia

www.sic.gov.co · National line: 592 0400

This document is a translation of the Spanish version. In case of any discrepancy, the Spanish version prevails.