Personal Data Processing Policy

0. Legal framework (Colombia)

This policy is governed mainly by Law 1581 of 2012, Decree 1377 of 2013 and any rules that add to, amend or replace them, as well as by the instructions of the Superintendence of Industry and Commerce (SIC) on personal data protection.

1. Who is the data controller?

This policy belongs to CloudTing, which acts as the controller of personal data.

Legal name: CloudTing | Tax ID (NIT): 901393894-1 | Domicile: Ibagué, Tolima, Colombia | Address: Cra 2 Sur # 81-16 | Phone: +57 305 402 8586.

Official email for data protection (habeas data) inquiries or complaints: informacion@cloudting.com.co.

2. Who does it apply to?

It applies to the data of individuals who interact with CloudTing, including website visitors, prospects, clients, suppliers and partners.

3. What data do we process?

• Identification and contact data: name, email, phone, company and job title.
• Business data: cloud needs, operational challenges and information shared in meetings or forms.
• Technical browsing data: traffic source and interaction events (for example clicks) to measure conversion and improve the experience.
• Contact data from external channels: messages received through WhatsApp Business or by email.

Note: CloudTing does not intentionally request sensitive data (for example health, biometrics, political or religious views) or data about minors. If such data is received by mistake, it will be processed only as strictly necessary and may be deleted at the data subject's request.

4. Purposes of processing

• Answer requests about AWS services, support and automation/AI.
• Schedule discovery calls, demos and follow-up meetings (Google Calendar).
• Prepare proposals, assessments, contracts and operational deliverables.
• Send technical or commercial information related to the requested service.
• Measure conversion and digital experience to improve the website and contact channels.
• Comply with legal, contractual and information security obligations.

5. Authorization and legal basis

Processing is carried out with the prior, express and informed authorization of the data subject, except where the law provides otherwise. Authorization may be given by completing forms, requesting contact or accepting this policy in CloudTing's service channels.

6. Rights of the data subject

As a data subject, you can:

• Know, update and correct your personal data.
• Request proof of the authorization you gave.
• Be informed about how your data is used.
• File a complaint with the SIC where applicable.
• Revoke the authorization and/or request deletion where appropriate.
• Access your personal data free of charge.

7. Procedure for inquiries and complaints (habeas data)

To exercise your rights, write to informacion@cloudting.com.co with the subject “Protección de datos” (data protection). Include at least:

• Full name of the data subject and a contact method.
• A clear description of the request (inquiry or complaint).
• If applicable: supporting documents.

Response times (business days):

• Inquiries: up to 10 business days (maximum extension of 5 business days).
• Complaints: up to 15 business days (maximum extension of 8 business days).

8. Processors, transmission and transfers

CloudTing may share data with processors that support its operations (for example: website hosting, analytics, meeting scheduling and messaging), under instructions and reasonable security measures.

In the event of an international transfer or transmission of data, the applicable legal and contractual safeguards will be used to protect the information.

9. Cookies and analytics

We may use cookies or analytics tools to understand how the site is used, detect exit points and improve conversion. You can set your browser to block or delete cookies; some features may be affected.

10. Information security

• We apply reasonable technical, logical and administrative controls to protect data.
• We limit access by role and need to know.
• We do not sell personal databases to third parties.

11. Retention

We keep data only for as long as needed to fulfill the stated purposes, contractual obligations or legal requirements. When the information is no longer needed, it is deleted or anonymized.

12. Effective date and changes

This policy is effective from its publication on the CloudTing website. Any relevant change will be published at this same address with the corresponding date.