Personal Data Processing Policy

Octava Ingeniería S.A.S. · Tax ID (NIT) 901.867.732-2 · Effective October 19, 2026

This is a translation for reference. In case of any discrepancy, the Spanish version prevails.

1. Data controller

Octava Ingeniería S.A.S., Tax ID (NIT) 901.867.732-2, located at Calle 42C #88-64, Medellín, Antioquia, Colombia.

• Email: comercial@octavaingenieria.com
• Phone and WhatsApp: +57 319 348 8565
• Website: octavaingenieria.com

2. Legal framework

This policy is issued under articles 15 and 20 of the Colombian Constitution, Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and any rules that amend or complement them.

3. Definitions

• Authorization: the data subject's prior, express and informed consent to the processing of their personal data.
• Personal data: any information linked or that can be linked to one or more identified or identifiable natural persons.
• Sensitive data: data that affects the data subject's privacy or whose misuse may lead to discrimination.
• Data subject: the natural person whose personal data is processed.
• Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
• Controller: the party that decides on the database and/or the processing of the data.
• Processor: the party that processes data on behalf of the controller.
• Transmission: sharing personal data with a processor, inside or outside Colombia, so it can process the data on the controller's behalf.

4. Data we collect

• Website contact form: name, phone, email, project type, the message the data subject writes and the site language.
• WhatsApp, email and calls: the data the data subject chooses to share when contacting us.
• Business or contractual relationship: identification, contact and billing data of clients, suppliers and contractors, and the information needed for each project's technical procedures (for example, with the grid operator).
• Website browsing: technical usage information such as pages visited, device and browser type, approximate location and traffic source. Analytics cookies are only stored if the visitor accepts them (see section 11).

We do not request sensitive data through the website, and we ask that it not be included in messages. When it is exceptionally required, providing it is optional and the data subject is not required to authorize its processing.

5. Purposes of processing

• Responding to information requests, quotes and technical visits.
• Contacting the data subject by phone, WhatsApp or email about their request.
• Preparing proposals and entering into and performing engineering service contracts.
• Carrying out the technical and regulatory procedures of each project, such as approvals with grid operators and RETIE certifications.
• Invoicing and complying with accounting, tax and legal obligations.
• Sending information about our services, unless the data subject has opted out.
• Producing website usage statistics to improve the site (see section 11).

6. Authorization

Octava Ingeniería S.A.S. requests the data subject's authorization no later than when the data is collected. On the website, authorization is given by checking the box in the contact form. It may also be given in writing, orally or through unequivocal conduct, and proof of it is kept.

The website is not aimed at minors. Data of children and adolescents will only be processed with the authorization of their legal representative, respecting their best interests and fundamental rights.

7. Data subject rights

Under article 8 of Law 1581 of 2012, the data subject has the right to:

• Access, update and correct their personal data.
• Request proof of the authorization given.
• Be informed about how their data has been used.
• File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law, after completing the inquiry or claim process with Octava Ingeniería S.A.S.
• Revoke the authorization and/or request deletion of their data, when there is no legal or contractual duty to keep it.
• Access their personal data free of charge.

8. Inquiries and claims

Data subjects, their successors or representatives may exercise their rights by writing to comercial@octavaingenieria.com with the subject “Personal data protection”. The request must include the data subject's name and ID, a description of the request, a reply address or email, and any supporting documents.

• Inquiries: answered within ten (10) business days of receipt. If that is not possible, the reasons will be given and the answer will be sent no later than five (5) business days later.
• Claims (correction, update, deletion or breach): answered within fifteen (15) business days from the day after receipt, extendable by up to eight (8) business days with notice of the reasons. If a claim is incomplete, the data subject will be asked to complete it within five (5) days of receipt. If two (2) months pass without it being completed, it will be considered withdrawn.

The Management of Octava Ingeniería S.A.S. is responsible for handling these requests.

9. Processors and international transmission

To run the website and our contact channels we use technology providers acting as processors, some with servers outside Colombia:

• Netlify, Inc. (United States): website hosting and receipt of contact form messages.
• Google LLC (United States): Google Tag Manager (management of the site's tags) and Google Analytics (measurement of site usage), as described in section 11.
• Email, messaging and cloud storage providers used to manage communications with data subjects.

These transmissions are made to fulfill the purposes of this policy, under the conditions of article 25 of Decree 1377 of 2013 and with the data subject's authorization. We do not sell or transfer personal data to third parties.

10. Security and retention

We apply reasonable technical, human and administrative measures to protect data against loss, unauthorized access, use or consultation. Data is kept for as long as needed to fulfill the purposes described and the applicable legal or contractual obligations.

11. Cookie policy

Cookies are small files a website stores in the visitor's browser. This site uses:

• Necessary storage: we store the visitor's cookie choice in the browser (key octava_cookie_consent) so we don't ask again on every visit. It does not identify the person.
• Analytics cookies (Google Analytics 4): _ga and _ga_<ID>, lasting up to two (2) years. They count visits and show how the site is used. They are only stored if the visitor accepts them in the cookie notice. Until then, Google Analytics stores no cookies in the browser and only receives basic visit signals, without cookies or identifiers, which Google uses in aggregate.

We do not use advertising or ad-tracking cookies.

Visitors can change their choice at any time with the “Cookie preferences” link at the bottom of every page, or delete cookies in their browser settings.

12. Effective date and changes

This policy is effective as of October 19, 2026. Any substantial change will be published on this page before it applies and, when required, new authorization will be requested from the data subject.