Personal Data Processing Policy

KARROT COLOMBIA S.A.S. · Updated March 18, 2026

Legal framework and scope

This Personal Data Processing Policy is prepared in accordance with the Colombian Political Constitution, Law 1581 of 2012, its regulatory decrees, and other complementary provisions, and will be applied jointly or individually by KARROT COLOMBIA S.A.S., a company identified with Tax ID (NIT) 901726090-8 (“KARROT”), with respect to the collection, storage, use, circulation, deletion, and all other activities that constitute the processing of personal data.

Definitions

For the purposes of this policy and in accordance with applicable law, the following definitions apply:

  • Authorization: The Data Subject’s prior, express, and informed consent to carry out the Processing of personal data.
  • Privacy notice: A physical, electronic, or other document made available by the Data Controller to the Data Subject regarding the processing of their personal data, communicating the existence of the applicable processing policies, how to access them, and the intended purpose of the processing.
  • Database: An organized set of personal data subject to Processing.
  • Personal data: Any information linked to, or that may be associated with, one or more identified or identifiable natural persons.
  • Public data: Data classified as such under the law or the Constitution, and any data that is not semi-private, private, or sensitive — for example, data on marital status, profession, or status as a merchant or public official, and any data obtainable without restriction.
  • Private data: Data that, due to its intimate or reserved nature, is relevant only to the data subject.
  • Sensitive data: Data that affects the Data Subject’s privacy or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political affiliation, religious or philosophical beliefs, union or human-rights membership, health, sex life, and biometric data.
  • Data Processor: A natural or legal person, public or private, that processes personal data on behalf of the Data Controller.
  • Data Controller: A natural or legal person, public or private, that decides on the database and/or the Processing of the data.
  • Data Subject: The natural person whose personal data is processed.
  • Processing: Any operation performed on personal data, such as collection, storage, use, circulation, or deletion.

Purpose of the collection and processing of personal data

KARROT may use personal data to:

  • Execute the contractual and commercial relationship with its users, clients, suppliers, and employees.
  • Provide the services and/or products requested by its users.
  • Inform users about new products or services and/or changes to them.
  • Evaluate the quality of the service.
  • Conduct internal studies on consumption habits.
  • Send commercial, advertising, or promotional information — its own or from third parties — via mail, email, phone, or mobile device (SMS/MMS) or any other current or future communication channel, to promote campaigns, promotions, or contests carried out by KARROT and/or third parties.
  • Carry out recruitment, evaluation, and hiring processes.
  • Support internal or external audit processes.
  • Register employee and/or pensioner (active and inactive) information in KARROT’s databases.
  • Share personal data with KARROT’s affiliated, related, or subordinate companies located in Colombia or elsewhere, when they require it for the purposes indicated here.
  • Evaluate the background and suitability of KARROT’s users, directly or indirectly.
  • Provide benefits to users as unilaterally determined by KARROT.
  • Conduct “know your customer” evaluations for user onboarding, which may include reviewing databases of public authorities, restrictive lists, and press media, among others.

Data (i) collected directly at KARROT’s security checkpoints, (ii) taken from documents provided by individuals to security personnel, and (iii) obtained from video recordings inside or outside KARROT’s facilities will be used for the safety of persons, assets, and facilities, and may be used as evidence in any type of proceeding.

Personal data provided will be used solely for the purposes stated herein, and KARROT will not sell, license, transfer, or disclose it, except when:

  • There is express authorization to do so.
  • It is necessary to allow contractors or agents to provide the contracted services.
  • It is necessary to provide KARROT’s or third parties’ services and/or products.
  • It must be disclosed to entities providing marketing services on behalf of KARROT, or to partners under joint marketing agreements.
  • The information relates to a merger, consolidation, acquisition, divestiture, or other corporate restructuring.
  • It is required or permitted by law.

KARROT may subcontract third parties to process certain functions or information. When this occurs, KARROT will require those third parties to protect the personal information with appropriate security measures.

Principles applicable to the processing of personal data

The processing of personal data at KARROT is governed by the following principles:

  • Purpose: Processing must serve a legitimate purpose, which must be communicated to the Data Subject.
  • Freedom: Processing may only take place with the Data Subject’s prior, express, and informed consent.
  • Truthfulness / quality: Information must be truthful, complete, accurate, up to date, verifiable, and understandable; partial, incomplete, or misleading data may not be processed.
  • Transparency: The Data Subject has the right to obtain, at any time and without restriction, information about the existence of data concerning them.
  • Restricted access and circulation: Personal data, other than public information, may not be made available on the Internet or other mass media unless access can be technically restricted to Data Subjects or authorized third parties.
  • Security: Information must be protected with the technical, human, and administrative measures necessary to prevent adulteration, loss, or unauthorized or fraudulent access, use, or consultation.
  • Confidentiality: Everyone involved in the Processing of personal data must keep the information confidential, even after their involvement ends.

First paragraph: When sensitive personal data is collected, the Data Subject may decline to authorize its Processing.

Data Controller

In accordance with Law 1581 of 2012 and Regulatory Decree 1377 of 2013, the following information about the data controller is provided:

  • Legal name of the data controller: KARROT COLOMBIA S.A.S.
  • Email address of the data controller: contacto.colombia@karrotup.com
  • Database retention period: Information collected about users is stored by KARROT for 5 years from the day it is provided; after that, it is deleted.

Rights of the data subjects

Data Subjects, directly or through a representative, attorney-in-fact, or successor, may exercise the following rights with respect to personal data processed by KARROT:

  • Right of access: to consult, free of charge, the personal data KARROT holds about them, at least once each calendar month and whenever there are substantial changes to this Policy.
  • Right of update, rectification, and deletion of personal data, so that the purposes of processing are satisfied.
  • Right to request proof of authorization, except where the law does not require it.
  • Right to be informed about the use of their personal data.
  • Right to file complaints with the Superintendence of Industry and Commerce for violations of applicable regulations.
  • Right to require compliance with orders issued by the Superintendence of Industry and Commerce.

Minors’ and sensitive data

If data of minors is received, KARROT will follow applicable regulations, always acting in the minor’s best interest and respecting their fundamental rights. KARROT avoids processing Sensitive Data where possible; where required, Data Subjects are not obliged to answer questions involving this category of data.

First paragraph: To exercise the rights described above, both the Data Subject and their representative must prove their identity and, where applicable, their authority to represent the Data Subject.

Second paragraph: The rights of minors are exercised through the persons authorized to represent them, who are responsible for defending those rights.

KARROT’s duties

Everyone bound by this Policy must bear in mind that KARROT is legally required to fulfill the following obligations:

Duties as Data Controller

  • Request and retain a copy of the authorization granted by the Data Subject.
  • Clearly inform the Data Subject about the purpose of collection and their rights.
  • Inform the Data Subject, on request, about the use given to their personal data.
  • Process inquiries and claims as set out in this Policy.
  • Uphold the principles of truthfulness, quality, security, and confidentiality.
  • Retain information under the security conditions necessary to prevent adulteration, loss, or unauthorized or fraudulent access.
  • Update information when necessary and rectify personal data when applicable.

Duties as Data Processor

When KARROT processes data on behalf of another Data Controller, it must:

  • Verify that the Data Controller is authorized to provide the data to be processed.
  • Guarantee the Data Subject’s full and effective exercise of the right of habeas data at all times.
  • Retain information under the necessary security conditions.
  • Timely update, rectify, or delete data, and update information reported by Data Controllers within five (5) business days of receipt.
  • Process inquiries and claims filed by Data Subjects as set out in this Policy.
  • Record in the database the legend “claim in process” and, where notified of judicial proceedings, “information under judicial discussion.”
  • Refrain from circulating information disputed by the Data Subject and blocked by order of the Superintendence of Industry and Commerce.
  • Allow access to information only to persons authorized by the Data Subject or by law.
  • Inform the Superintendence of Industry and Commerce of security violations or risks, and comply with its instructions.

Duties when processing through a Data Processor

  • Provide the Data Processor only with data whose processing is previously authorized, executing a data-transfer agreement or contractual clauses per Article 25 of Decree 1377 of 2013 for national or international transfers.
  • Guarantee that the information provided is truthful, complete, accurate, up to date, verifiable, and understandable.
  • Promptly communicate updates or rectifications to the Data Processor and require respect for security and privacy conditions at all times.
  • Inform the Data Processor when information is under discussion by the Data Subject and the claim has not been resolved.

Duties toward the Superintendence of Industry and Commerce

  • Report any violations of security codes and risks in the administration of Data Subjects’ information.
  • Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

Requesting the Data Subject’s authorization

Before and/or when collecting personal data, KARROT will request the Data Subject’s Authorization, indicating the purpose of the request, using automated, written, or oral means that preserve proof of the Authorization or of the unequivocal conduct described in Article 7 of Decree 1377 of 2013. The Authorization will be requested for as long as reasonably necessary to meet the purpose of the request, in compliance with applicable law.

Privacy notice

If KARROT is unable to make this Policy available to a Data Subject, it will instead publish the attached Privacy Notice, which will be retained for later consultation by the Data Subject and/or the Superintendence of Industry and Commerce.

Time limits on the processing of personal data

KARROT will only collect, store, use, or circulate personal data for as long as reasonably necessary for the purposes that justified the Processing, considering administrative, accounting, tax, legal, and historical factors. Once the purpose is fulfilled, data will be deleted unless the law requires otherwise — for example, data required for tax reporting or that is tied to an outstanding contractual balance owed to the Data Subject or to KARROT will be retained accordingly.

Responsible area and claims procedure

KARROT’s ADMINISTRATIVE AREA is responsible for handling petitions, complaints, and claims regarding the rights set out in Article 6 of this Policy (except the right described in literal e). Data Subjects or their representatives may submit these to KARROT’s offices, website, or mobile application.

A claim must include (i) the Data Subject’s identification, (ii) a description of the facts, (iii) contact information, and (iv) supporting documents. If incomplete, the applicant has five (5) business days from notice to correct it; after two (2) months without a response, the claim is deemed withdrawn.

If the recipient of the claim is not competent to resolve it, it will be forwarded within two (2) business days. Once complete, the database will show “claim in process” within two (2) business days, maintained until resolved. Claims are addressed within fifteen (15) business days of receipt; if more time is needed, the Data Subject will be informed of the reasons and the new date, which may not exceed eight (8) additional business days.

Security measures

In furtherance of the security principle set out in Law 1581 of 2012, KARROT will adopt the technical, human, and administrative measures necessary to protect records from adulteration, loss, or unauthorized or fraudulent access, and will implement protocols to keep information secure.

Authorization for inquiries and reports

The User declares that the information provided on the Platform and during the commercial relationship is truthful, and gives express and irrevocable consent to KARROT to:

  • Consult, at any time, any credit bureau or database (such as Colombian financial institutions’ information centers or DataCrédito) for information relevant to credit risk studies and marketing or product offerings.
  • Report to any credit bureau or database data on compliance or non-compliance with credit, commercial, or service obligations, plus location and contact data, within the limits of Law 1266 of 2008.
  • Provide to any credit bureau or database information related to credit applications and other commercial, financial, and socioeconomic data provided by the User.

Governing law and jurisdiction

Any interpretation, judicial, or administrative action arising from the processing of personal data is subject to the data-protection regulations of the Republic of Colombia, whose competent authorities will resolve any question, complaint, or claim regarding it.

Effective date

This Personal Data Policy takes effect upon publication on KARROT’s website.

Annex: Privacy Notice

In addition to the Policy above, KARROT COLOMBIA S.A.S. makes the following Privacy Notice available to Data Subjects; its purposes and applicable rights are the same as those described in the “Purpose of the collection and processing of personal data” and “Rights of the data subjects” sections of this Policy.

This Personal Data Processing Policy can be consulted at KARROT COLOMBIA S.A.S.’s physical offices and on its website.

KARROT COLOMBIA S.A.S.’s ADMINISTRATIVE AREA is responsible for handling petitions, complaints, and claims regarding the rights set out in section 6 of the Personal Data Processing Policy (except the right described in literal e). Data Subjects or their representatives may submit these through the website.