Privacy and personal data policy

This policy explains what personal data BOTTA Software processes, what we use it for and how you can exercise your rights. We adopt it to comply with Colombian Law 1581 of 2012, Decree 1377 of 2013 (incorporated into Decree 1074 of 2015) and the other Colombian personal data protection rules. This is a translation; if it differs from the Spanish version, the Spanish version prevails.

1. Who is responsible for your data

BOTTA SOFT S.A.S. (hereinafter, BOTTA Software), tax ID (NIT) 901.391.360-1, domiciled in La Estrella, Antioquia, Colombia.

• Address: Carrera 50D # 77 Sur - 81, La Estrella, Antioquia, Colombia
• Email: support@botta.com.co
• Phone and WhatsApp: +57 316 177 2422
• Website: botta.com.co

2. Terms we use

• Data subject: the person the data is about. In this policy, you.
• Processing: any operation on personal data, such as collecting, storing, using, sharing or deleting it.
• Controller (responsable): whoever decides why and how the data is processed. For the data in this policy, BOTTA Software.
• Processor (encargado): whoever processes data on the controller’s behalf and following its instructions, for example a hosting provider.
• Transmission: sending data to a processor, in Colombia or abroad, so it can process it on the controller’s behalf.
• Transfer: sending data to another controller, in Colombia or abroad.

3. What data we collect

When you message us on WhatsApp or by email. We receive the data you choose to share: your name, phone number, email address, company and job title, and the content of your message.

When you browse this site. The site has no forms. Our hosting provider, Cloudflare, processes technical data such as your IP address and browser type to deliver the site and protect it from attacks.

Cookies. We do not use analytics, advertising or tracking cookies. Cloudflare may use strictly necessary technical cookies to protect the site from malicious traffic. Apart from that, the site stores your language and light/dark theme preference in your own browser (in local storage, not a cookie). That data is not sent to us and you can clear it from your browser settings.

We do not ask for sensitive data and do not knowingly collect data from children or adolescents through this site.

4. What we use your data for

• Replying to your messages and requests.
• Understanding your project, preparing proposals and scheduling meetings.
• If we reach an agreement, performing the contract: project communication, support, invoicing and payment.
• Sending you information about our services and products, only if you authorize it. You can ask us to stop at any time.
• Meeting our legal, accounting and tax obligations.
• Keeping the site and our systems secure.

5. Your authorization

When you message us and send us your data so we can get in touch, you authorize us to process it to handle your request and for the related purposes in section 4. Before sending you marketing communications you did not ask for, we will ask for your express authorization.

The law does not require your authorization when a public body or a court order requests the data, for public data or civil registry data, in medical or health emergencies, or for historical, statistical or scientific purposes authorized by law.

6. Who we share your data with

We do not sell or rent your data. We share it only with providers that help us operate and process it on our behalf, such as:

• Meta Platforms (WhatsApp), for WhatsApp conversations.
• Our email provider.
• Cloudflare, for hosting and site security.

These providers commit, in their contracts and terms of service, to process the data only to provide their service to us and to protect it. Some have servers outside Colombia, for example in the United States, so your data may be transmitted to other countries. We choose providers with adequate data protection standards.

We may also disclose data to an authority when a law or court order requires it.

7. How long we keep it

We keep your data for as long as we need it for the purpose it was collected for. If you contacted us and we did not end up working together, we keep it for up to two years after the last contact, unless you ask us to delete it sooner. If you are a client, we keep it during the relationship and afterwards for as long as accounting, commercial and tax rules require.

8. Your rights

As the owner of your data you have the right to:

• Know, update and correct your data.
• Request proof of the authorization you gave us.
• Be told, on request, how we have used it.
• Revoke your authorization or ask us to delete your data, when we have no legal or contractual duty to keep it.
• Consult your data free of charge, at least once every calendar month and whenever we make substantial changes to this policy.
• File complaints with the Superintendence of Industry and Commerce (SIC) for breaches of the law, after first making your inquiry or claim with us.

9. How to exercise your rights

These rights can be exercised by you, your successors, your representative or attorney, or someone acting under a stipulation in favor of another, on proof of that status.

Email support@botta.com.co with the subject “Personal data” and include your name, your ID document, what you are asking for and how you want to receive the answer. If you are acting on behalf of someone else, attach the document that authorizes you.

• Inquiries (finding out what data we hold and how we use it): we answer within 10 business days at most. If we cannot meet that deadline, we will tell you why and answer within the following 5 business days.
• Claims (correcting, updating or deleting data, revoking authorization or reporting a breach): we answer within 15 business days at most. If we cannot meet that deadline, we will tell you why and answer within the following 8 business days. If a claim is missing information, we will ask you to complete it within 5 days; if two months pass without a reply, we will consider it withdrawn. While we resolve a complete claim, we flag your data as “claim in progress” within 2 business days of receiving it.

The BOTTA Software team handles these requests through that same email address.

10. Data in our products and in the software we build

When a client uses our products (such as Bscreen or Atiende) or software we built for them, the data that client uploads or receives there, for example conversations with their own customers, is that client’s responsibility. In those cases BOTTA Software acts as a data processor: it processes the data only to provide the service, following the client’s instructions and the terms of the contract.

The client is responsible for having the authorization of the people whose data it uploads or communicates with through the product, and for complying with the policies of the channels it uses, such as WhatsApp Business. When the contract ends, we return or delete that data as agreed. Each product may have its own terms, which prevail on the matters they specifically cover.

11. Security

We apply reasonable technical and organizational measures to protect your data, such as encrypted connections (HTTPS) and restricting access to information to those who need it. No system is completely secure, but we work to reduce the risks.

12. Changes to this policy

If we change this policy, we will publish the new version on this page with its update date. If a change affects the purposes we use your data for, we will let you know beforehand and, where required, ask for a new authorization.

13. Effective date

Version 1.0. This policy is effective as of October 18, 2026.