Personal data processing policy

In compliance with the data-protection regulations applicable in each LATAM country where we operate (for example, in Colombia Law 1581 of 2012 and its regulatory decrees; and the equivalent laws in Mexico, Peru, Chile, Argentina, Brazil, Ecuador, among others), TODOMIS SAS (Colombia, NIT 901.325.484-2) and TODOMIS SPA (Chile, RUT 78.172.757-1) ("the Controller") adopt this policy.

1. Data controller

• Colombia — TODOMIS SAS, NIT 901.325.484-2. Address: Carrera 26A # 10-23, Medellín, Colombia. Phone: +57 301 368 2189.
• Chile — TODOMIS SPA, RUT 78.172.757-1. Address: Antonio Bellet 193, of. 1210, floor 12, Providencia, Santiago, Chile. Phone: +56 9 4401 2291.
• Email (both): info@miscostosfijos.com

2. Roles: controller and processor

We are controllers of your account and contact data. For the data you upload about third parties (clients, suppliers, employees), we act as processors, handling it on your behalf and according to your instructions. In that case, you are the controller vis-à-vis those data subjects.

3. Data processed

Identification and contact data (name, email, phone, company, country), platform usage data and the financial information and documents the user decides to upload. We don't request sensitive data for the Service to work.

4. Purposes

• Provide, maintain and improve the Service.
• Handle contact, support and partners-program requests.
• Send communications related to the account and the service.
• Prevent fraud and ensure security.
• Comply with legal and contractual obligations.

5. Authorization

By registering or submitting a form, you give prior, express and informed authorization for the processing of your data for the described purposes. You can revoke this authorization whenever you want, with no retroactive effect.

6. Data subject rights

• Know, access, update and rectify your data.
• Request proof of the authorization given.
• Be informed about the use given to your data.
• Object to processing and request deletion, where applicable.
• Revoke the authorization.
• File complaints with the competent data-protection authority in your country (for example, in Colombia the Superintendency of Industry and Commerce).

7. Procedure to exercise rights

Send your request to info@miscostosfijos.com stating your identification, the right you wish to exercise and your contact details. We'll respond within the legal timeframes applicable in your country; if the request is incomplete, we'll ask you to complete it.

8. Sharing and subprocessors

We may rely on providers (for example, infrastructure on Google Cloud and an email-sending provider) under confidentiality and processing agreements. We don't sell personal data.

9. Security and transfer

We apply technical and organizational measures to protect the data. By using cloud infrastructure, data may be processed outside your country under adequate safeguards.

10. Term and retention

This policy is effective from its publication. We keep the data while there is a relationship with the data subject and for the applicable legal periods; afterwards they are deleted or anonymized.

11. Glossary

• Data subject: person whose data is processed.
• Controller: who decides on the processing.
• Processor: who processes data on behalf of the controller.
• Processing: any operation on personal data.
• Authorization: the data subject's consent to processing.