Personal Data Processing Policy

This policy is issued under Article 15 of the Colombian Constitution, Law 1581 of 2012, Decree 1074 of 2015 (which incorporates Decree 1377 of 2013), Law 1266 of 2008 where applicable, and the instructions of the Superintendence of Industry and Commerce (SIC). For data subjects and operations in the United States, Integry also applies the Gramm-Leach-Bliley Act (GLBA), its Privacy Rule and Safeguards Rule (16 CFR Part 314), and applicable state law.

Integry processes personal data under the principles of legality, purpose limitation, freedom, accuracy, transparency, restricted access and circulation, security, and confidentiality set out in Article 4 of Law 1581 of 2012.

When identity verification involves biometric data, such as a photo or facial recognition, Integry will request express authorization and will inform the data subject that they are not required to authorize the processing of sensitive data. Integry will offer an alternative verification method where possible.

IntPay's services are not directed at minors. Integry does not knowingly collect data from children or adolescents and, if it does process such data, will respect their best interests and fundamental rights.

Integry obtains the data subject's authorization in advance, in writing, electronically, or through unequivocal conduct, and keeps evidence of it. Authorization is not required in the cases listed in Article 10 of Law 1581 of 2012, such as information requested by a public entity in the exercise of its functions or data of a public nature. For Payers' data, the Merchant, as controller, must obtain the corresponding authorization.

Data subjects, their successors, or their representatives may submit inquiries and claims to info@integry.co or to Integry's physical address. The request must include the data subject's identification, a description of the facts, a reply address, and any supporting documents.

Inquiries: answered within a maximum of ten (10) business days from receipt. If that is not possible, the reasons will be given and the inquiry answered within five (5) business days after the first period expires.

Claims: resolved within a maximum of fifteen (15) business days from the day after receipt. If that is not possible, the reasons will be given and the claim resolved within eight (8) business days after the first period expires. If a claim is incomplete, the claimant will be asked to complete it within five (5) days. If it is not completed within two (2) months, the claim will be deemed withdrawn.

Integry may transmit data to processors that provide payment processing, cloud infrastructure, identity verification, and support services, in Colombia or abroad, under data transmission agreements requiring them to process the data only on Integry's instructions and with adequate security measures.

Integry may transfer data to financial institutions, payment networks, Partners, and authorities when needed to process an operation or comply with the law. Because payments between Colombia and the United States are cross-border, some data is transferred to the United States. These transfers are made with the data subject's express authorization or when necessary to carry out the payment transaction, in accordance with Article 26 of Law 1581 of 2012 and the SIC's instructions. Integry does not sell personal data.

Integry S.A.S. holds ISO 27001 certification for information security management and applies technical, human, and administrative controls such as encryption in transit and at rest, access control, audit logs, and incident management. Card data is processed exclusively through PCI-DSS certified processors. Security incidents affecting personal data will be reported to the SIC and to data subjects where required by law.

Data will be kept for as long as the relationship with the data subject lasts and for the period required by legal, accounting, tax, foreign exchange, and AML/CFT obligations. For a merchant's books and records, that period is at least ten (10) years. Once the period ends, the data will be securely deleted or anonymized.

For data subjects whose data is processed in connection with financial services in the United States, Integry provides the privacy notices required by the GLBA. Integry shares nonpublic personal information (NPI) only with service providers, Partners, and authorities as that law permits, and does not share it with non-affiliated third parties for marketing purposes. Data subjects may exercise any additional rights granted by the law of their state of residence by writing to info@integry.co.

Integry will register its databases, and keep them up to date, in the National Database Registry (RNBD) administered by the SIC, under the terms and deadlines that apply to it.

This policy applies from the date shown at the top and remains in force while Integry processes personal data. Material changes will be communicated to data subjects before they take effect through this website or the registered contact channels. The databases will remain in force for as long as the purposes justifying the processing continue.