Store Privacy and Personal Data Processing Policy

1. Data controller

Data controller: Andrés Felipe Restrepo Mesa

Trade name: Alamarte Engineering

Type of controller: Natural person

NIT: 98.546.089-5

Address: Carrera 1 # 42-141, Playa El Francés, Santiago de Tolú, Sucre, Colombia, postal code 706010

Phone: +57 301 495 0065

Email:

Website: alamarte.com

2. Data that may be processed

Depending on the features used by the user, the store may process the following categories of information:

• Name and identification information provided during registration or purchase.
• Email address, phone number and other contact information provided by the user.
• Information required for invoicing or compliance with commercial, accounting and tax obligations.
• Information about orders, purchased products, amounts, dates, payment statuses and transaction references.
• Data related to downloads, updates, renewals, licences and support for purchased products.
• Communications, requests, inquiries, petitions, complaints or claims related to the store.
• Technical records required for security, operation, diagnostics and prevention of misuse of the website and its services.

3. Purposes of processing

Personal data may be processed to:

• Create and manage the user's account.
• Process orders and verify payment status.
• Enable downloads and access to purchased digital products.
• Manage updates, renewals, keys and services associated with Alamarte Pro products.
• Provide support related to products or orders.
• Send transactional communications necessary for the operation of the store.
• Respond to inquiries, petitions, complaints, claims and requests related to personal data.
• Prevent fraud, abuse, unauthorized access and other security incidents.
• Comply with legal, contractual, accounting, tax and consumer protection obligations.

4. Authorization for processing

When authorization is required by law, it will be requested in advance and on an informed basis through the mechanisms provided on the website so that evidence of the authorization may be retained.

The authorization covers only the purposes disclosed to the data subject and may be revoked or modified in the cases and under the conditions established by Colombian law.

The provision of sensitive data will be optional if any such data is ever requested. The store does not normally require sensitive personal data to complete a purchase of digital products.

5. Payment processing

Electronic payments for the store may be processed through Wompi or other payment gateways that may be enabled in the future.

When the user uses Wompi, the information required to process the payment method is managed by that platform in accordance with its own terms, policies and security mechanisms.

Alamarte Engineering does not need to store full credit or debit card numbers or CVV security codes. The store receives and retains only the transaction information required to identify, verify and reconcile the payment, manage the order and comply with its obligations.

6. Processors and technology providers

To operate the store, it may be necessary to use providers that act as data processors or that process certain information in order to provide technology, hosting, email, payment processing, security, support or other necessary services.

Only the information necessary to fulfil the corresponding purpose will be provided to these providers, and reasonable efforts will be made to ensure that processing takes place under appropriate confidentiality and security conditions.

Purchase data will not be used to automatically subscribe the buyer to newsletters or commercial communications that require separate authorization.

7. Transfer and transmission of information

When providing a service requires personal data to be transmitted or transferred to providers located in Colombia or other countries, the processing will be carried out in accordance with the applicable personal data protection provisions and exclusively for authorized or legally permitted purposes.

Information may also be provided to public, administrative or judicial authorities when required by law, by a competent order or under any other circumstance permitted by applicable legislation.

8. Retention of information

Data will be retained for the period reasonably necessary to fulfil the purposes for which it was collected and for as long as a contractual, commercial or support relationship exists that justifies its processing.

Certain information may be retained afterwards when necessary to comply with legal, accounting, tax, contractual, consumer protection, security or claims-handling obligations.

When there is no longer a legitimate purpose or obligation justifying its retention, the data will be deleted, anonymized or otherwise processed as required under applicable regulations.

9. Information security

Reasonable technical, administrative and organizational measures will be applied to protect information against loss, alteration, unauthorized access, consultation, use or disclosure.

No system connected to the Internet can guarantee absolute security. Accordingly, protection measures will be reviewed and adjusted when necessary based on the nature of the data, the services used and the risks identified.

10. Rights of data subjects

Under Colombian law, the data subject may, among other rights:

• Know, update and correct their personal data.
• Request proof of the authorization granted when such authorization is required.
• Request information about how their data has been used.
• Access, free of charge, personal data that has been processed.
• Request deletion of the data or revoke authorization when legally applicable.
• File complaints with the Superintendencia de Industria y Comercio once the applicable consultation or complaint procedure with the data controller or processor has been exhausted, when required.

11. Personal data inquiries and complaints

The data controller handles inquiries and complaints related to the processing of personal data through .

The request must make it possible to identify the data subject and clearly describe the inquiry, correction, update, deletion, revocation or other request being submitted. When necessary, additional information may be requested to verify the identity or authority of the applicant.

Inquiries will be answered within a maximum period of ten (10) business days from receipt. If it is not possible to respond within that period, the interested party will be informed of the reasons for the delay and the date on which the inquiry will be answered. The additional period may not exceed five (5) business days after the expiry of the initial period.

If a complaint is incomplete, the interested party will be requested to provide the missing information within five (5) days following receipt of the complaint. If two (2) months have elapsed from the date of the request without the applicant providing the required information, the complaint will be deemed withdrawn.

If the person receiving the complaint is not competent to resolve it, the complaint will be transferred to the appropriate party within a maximum of two (2) business days, and the interested party will be informed of the situation.

Once a complete complaint has been received, the database or information system will include a record stating “complaint in progress” and the reason for the complaint within no more than two (2) business days. This record will remain until the complaint has been resolved.

Complaints will be handled within a maximum period of fifteen (15) business days beginning on the day following their receipt. If it is not possible to respond within that period, the interested party will be informed of the reasons for the delay and the date on which the complaint will be answered. The additional period may not exceed eight (8) business days after the expiry of the initial period.

12. Cookies and similar technologies

The store may use cookies and technical mechanisms required to maintain sessions, shopping carts, authentication, security and other website functions.

Specific information about their purposes and management is provided separately in the Store Cookie Policy.

13. Validity and updates to this policy

This policy enters into force upon its publication on alamarte.com.

This policy may be updated when the store's features, technology providers, processing purposes or applicable regulations change.

The databases and files covered by this policy will remain in force for as long as the purposes that justify the processing of personal data persist or as long as applicable legal or contractual obligations require their retention.

The current version will be available at alamarte.com and will indicate the date of its most recent update.