Confidentiality and personal data processing policy

1. Acceptance of this policy

Important: Use of any module of NAVA Software, regardless of the access channel (web application, mobile app, Google Play Store, or WhatsApp channel), implies the reading, understanding, and full acceptance of this Policy, as well as the due authorization of personal data. If the User does not accept the terms, they must refrain from using the software.

2. Purpose and scope

The purpose of this Integrated Confidentiality and Personal Data Processing Policy (hereinafter, the “Policy”) is to establish the rules, commitments, and responsibilities of LOGYKOS S.A.S. and of all users of NAVA Software with regard to:

• The processing of personal data collected through the platform’s various modules and channels, in compliance with Statutory Law 1581 of 2012 and Decree 1074 of 2015.
• The confidentiality of the technical, operational, and commercial information generated or viewed in the system.

This Policy applies to all parties that interact with NAVA Software:

• The Client: the company that hires LOGYKOS’s services and manages the platform.
• The Client’s Administrator: the employee who configures the platform and uploads third-party data.
• The Client’s Employee: the employee who accesses NAVA to view information about workers, contractors, suppliers, or visitors.
• The Contractor / Supplier: the third party whose data is managed within NAVA.
• The Visitor: the natural person registered in the Visitors module.
• The Client’s Worker (NAVA Skills): the employee who receives and completes training through WhatsApp.

3. Definitions

For the purposes of this Policy, the following terms have the meaning indicated:

4. Modules, access channels, and personal data processed

NAVA Software operates through different modules and channels, each with its own data subjects and types of data processed.

Sensitive data: The Contractor and Supplier Management module may include occupational medical exams and criminal background checks. This data is processed only with the Data Subject’s prior and express authorization.

5. Purposes of personal data processing

5.1. Contractor and supplier data

• Verify compliance with the legal, contractual, and safety requirements set by the Client.
• Manage and file qualification documents.
• Prepare compliance reports and performance reports.
• Control access to the Client’s facilities.
• Transmit information to the Client or sub-clients for review and approval.
• Store and process data on AWS infrastructure.

5.2. Visitor data

• Manage the entry and exit of people.
• Generate visit traceability records.
• Control access through WhatsApp or the application.

5.3. Data of the Client’s employees and administrators

• Authenticate access to NAVA Software.
• Log activity for auditing and security.
• Manage configurations and permissions.

5.4. Data of the Client’s workers in NAVA Skills

• Authenticate the worker’s identity.
• Deliver courses and assessments.
• Record results and scores.
• Generate certificates.
• Allow the employer to track progress.
• Meet legal training obligations.

6. Authorization for personal data processing

6.1. Contractors, suppliers, and visitors

The data is provided by the Client, who acts as Data Processor and guarantees that it has obtained the prior, express, and informed authorization of the Data Subjects.

6.2. The Client’s workers in NAVA Skills

LOGYKOS obtains authorization directly from the worker during the authentication flow in WhatsApp.

Processing notice — NAVA Skills. LOGYKOS S.A.S. (NIT, Colombian tax ID, 901.785.261-2) will process your personal data (name, national ID number, cell phone, and assessment results) for the purpose of managing the training process assigned by your employer, generating your certificate, and reporting results to your company’s administrator.

6.3. Sensitive data

For the processing of sensitive data, the Client guarantees that it has the Data Subject’s explicit authorization.

7. International data transfer

Personal data is stored on Amazon Web Services (AWS) servers located in the United States of America.

• AWS holds international security certifications.
• LOGYKOS has signed the corresponding data processing agreements.
• The data is not sold or assigned to AWS.
• Data subjects are informed of this international transfer.

In addition, the WhatsApp channel is operated by Meta Platforms Inc. (USA), whose policies also apply to the use of that channel.

8. Rights of data subjects

Under Article 8 of Law 1581 of 2012, every Data Subject has the following rights:

9. Procedure for exercising rights

9.1. Inquiries

The Data Subject may submit their inquiry through the following channels:

• Email: logykoss@gmail.com
• Address: CL 77 B No. 57-103, Piso 10, Ofc Regus, Edf. Green Tower, Barranquilla, Colombia.
• Hours: Monday to Friday, 8:30 AM to 12:00 PM and 2:00 PM to 6:00 PM.

LOGYKOS will respond within a maximum of ten (10) business days from receipt of the request, extendable by five (5) additional business days with notice of the reasons.

9.2. Claims (updating, correction, deletion, and revocation)

The request must include:

• Identification of the Data Subject.
• Contact information.
• Description of the data that is the subject of the claim.
• Description of the facts.
• Supporting documents.

LOGYKOS will resolve the claim within a maximum of fifteen (15) business days, extendable by eight (8) additional business days. While the claim is being processed, the notation “claim in process” will be included in the database.

9.3. Special cases for NAVA Skills

The Client’s workers who wish to exercise their rights over the data processed in NAVA Skills may do so directly with LOGYKOS through the channels indicated, or through their company’s administrator. LOGYKOS will coordinate with the Client to address the request.

10. Confidentiality of information

10.1. Information considered confidential

Confidential Information means all information that the User views, consults, or receives when using NAVA Software, including:

• Data about the Client’s contractors, suppliers, and visitors.
• Compliance documents: certificates, insurance policies, medical exams, and background checks.
• NAVA Skills assessment results and training certificates.
• Operational, logistical, or administrative information of the Client or its sub-clients.
• The software’s features, workflows, configurations, and technical integrations.
• Conversations and exchanges on the WhatsApp channel.

10.2. LOGYKOS’s obligations

• Implement technical, administrative, and organizational measures to protect Confidential Information against unauthorized access, alteration, or destruction.
• Use Confidential Information solely to provide the contracted service.
• Not disclose Confidential Information to third parties without the Client’s express authorization, except under a legal or judicial order.
• Notify the Client of any security breach that may compromise Confidential Information.
• Ensure that only authorized LOGYKOS personnel access the information, under internal confidentiality agreements.

10.3. User’s obligations

• Use access to NAVA Software solely for authorized purposes.
• Keep login credentials confidential.
• Not share, forward, or disclose Confidential Information to unauthorized third parties.
• Not take screenshots or recordings without express authorization.
• Report any unauthorized use detected.
• Protect the device used to access the WhatsApp channel.

10.4. Duration of confidentiality

Confidentiality obligations remain in effect during the period of use of NAVA Software and for two (2) additional years from the last recorded session or from the termination of the contract between the Client and LOGYKOS, whichever occurs first.

11. Roles and responsibilities in processing

12. Information security

In furtherance of the security principle established in Law 1581 of 2012, LOGYKOS has adopted the following measures:

• Storage on AWS with encryption in transit (TLS) and at rest.
• Username and password authentication for the web and mobile application.
• National ID number authentication in NAVA Skills.
• Role- and permission-based access control.
• Activity logging (logs) for auditing.
• Security incident response protocol.
• Confidentiality agreements with internal staff.

13. Data retention and deletion

Personal data will be retained for as long as necessary to fulfill the purposes for which it was collected and for the term of the contract with the Client.

Once the contract ends, the data will be deleted or returned to the Client within the following thirty (30) business days, unless there is a legal obligation to retain it.

NAVA Skills assessment results and training certificates will be retained for the term of the contract and for the additional period required for labor compliance purposes, without exceeding what applicable regulations allow.

14. Consequences of non-compliance

• Immediate suspension or cancellation of access to NAVA Software.
• Report of the detected non-compliance to the Client.
• Initiation of civil and/or criminal legal action.
• Report to the Superintendence of Industry and Commerce or other competent authorities.

15. Policy updates

LOGYKOS reserves the right to modify this Policy at any time to adapt it to regulatory or technological changes or to changes in the conditions of the service.

Changes will be communicated through a notice on the NAVA platform, the WhatsApp channel, publication on www.navapro.com.co, or direct notification to the Client.

16. Responsible department and contact information

17. Governing law and jurisdiction

This Policy is governed by the laws of the Republic of Colombia, in particular Statutory Law 1581 of 2012, Decree 1074 of 2015, and Law 1266 of 2008.

To resolve any dispute arising from its interpretation or application, the parties submit to the jurisdiction of the competent judges and courts of the city of Barranquilla, Colombia.