Personal Data Processing Policy

Big Ideas Solutions S.A.S., tax ID (NIT) 902.103.329-2, domiciled in Cali, Colombia, address AV 6 C NORTE 35 N 95, email info@bisideas.com and phone +57 317 528 8678 ("BIS").

This policy is issued under Colombian Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and any rules that amend or supplement them.

We do not request sensitive data or data from minors.

We process your data to:

• a) Schedule, confirm and hold the meeting you requested, and send you the confirmation with the video call link.
• b) Contact you about your request and, if you decide to move forward, prepare and send you a proposal.
• c) Measure use of the site in aggregate, only if you accepted analytics cookies.
• d) Keep the site secure and prevent abuse of the scheduler.
• e) Comply with legal, accounting and tax obligations.

We do not sell your personal data.

To run the site we share data with providers that process it on our behalf and under our instructions:

These providers are located outside Colombia. By authorizing the processing you accept this international transmission, which we carry out with providers that offer adequate data protection safeguards.

As the data subject you have the right to:

• a) Know, update and correct your data.
• b) Request proof of the authorization you gave us.
• c) Be informed about how we have used your data.
• d) File complaints with Colombia's Superintendence of Industry and Commerce (www.sic.gov.co), once you have gone through the procedure with us.
• e) Withdraw your authorization and/or request deletion of your data, when there is no legal or contractual duty to keep it.
• f) Access your data free of charge.

Write to info@bisideas.com, preferably from the address you used to contact us, with your name and what you are requesting: access, update or correction, deletion, withdrawal of authorization or proof of authorization. Requests are handled by: Personal Data Protection Department.

• Inquiries: answered within ten (10) business days of receipt. If that is not possible, we will tell you why and give you a new date, no more than five (5) additional business days later.
• Claims (correction, update, deletion, withdrawal or non-compliance): include your identification, a description of the facts, the address where you want the answer and any supporting documents. If the claim is incomplete we will ask you to complete it within five (5) days; if two (2) months pass without a reply, it will be considered withdrawn. We resolve claims within fifteen (15) business days, extendable by up to eight (8) more, telling you why.

To verify your identity we will reply to the email address you used with us. We will only ask for more information if there is reasonable doubt.

This site is intended for businesses and adults. We do not knowingly collect data from minors; if we find that we have, we will delete it.

Cookies are small files the site stores in your browser. We use two necessary cookies, which do not require consent because without them the site cannot remember your choices, and analytics cookies that are only turned on if you accept them. If you reject them, the site works the same.

Microsoft Clarity records how the page is used (movements, clicks and scrolling) to understand where people run into problems. The scheduler's fields are masked: their content is not recorded.

You can change your choice at any time from "Cookie settings" at the bottom of every page. If you withdraw consent, we delete the analytics cookies on our domain and stop loading those services.

We apply reasonable technical and organizational measures: encryption in transit (HTTPS), restricted access to provider accounts and validation of the data the scheduler receives. We keep the data of people who book a meeting for 24 months from the last contact; accounting data for as long as the law requires; and analytics data according to each provider's retention settings. After that we delete it.

Besides this site, BIS builds and operates software for businesses, such as customer relationship management (CRM) and WhatsApp messaging systems. In that service, each client business is the controller of its own contacts' data and BIS acts as a processor: it processes the data only on the client's behalf, under its instructions and to provide the contracted service.

Regarding this data we commit to:

• a) Use it only to provide the service to the client. We do not use it for our own purposes, we do not sell it and we do not use it for advertising.
• b) Process only the data needed for each purpose.
• c) Store access credentials encrypted and limit access to the data according to the role of each of the client's users.
• d) Send messages only on the client's instructions; the client is responsible for having its contacts' authorization to receive them.

To provide this service we use these providers:

We keep this data for as long as the service lasts. When the client disconnects its WhatsApp account or the contract ends, we stop processing it and, within ninety (90) days —the time needed to return the data to the client if it asks for it and for it to be removed from backups— we delete it, unless the law requires us to keep it.

If you are a contact of one of our clients, exercise your rights with that business. If you write to us at info@bisideas.com, we will forward your request to the client and help it respond. The person who connected a WhatsApp Business account can ask us to delete their name and Facebook ID by writing to the same address.

If a public authority asks us for personal data:

• a) We check that the request is lawful and that the authority is competent before responding.
• b) We challenge, through the available legal means, requests we consider unlawful or disproportionate.
• c) We disclose only the minimum data needed to comply.
• d) We keep a record of the request, our response and its legal grounds.
• e) We inform the affected client, unless the law prohibits it.

This policy is effective from September 29, 2026. The databases will remain in force for as long as the purposes described and the retention periods apply. We will publish any material change on this site before applying it.