Personal Data Processing Policy and Privacy Notice

1. Data controller

TESSIQ (in the process of incorporation), represented by Santiago Ceron, is the controller of the personal data collected through TESSIQ COST.

The company has not been incorporated yet. Once it exists, this document will be updated with its legal name, tax ID (NIT) and address.

Channel for queries, complaints and requests: datos@tessiqcost.com

2. Data we collect

When you sign up and use the service we process the following data:

• Email address and full name.
• Password, which is stored protected by a hash and never in plain text.
• Preferred language.
• The date and version of the authorization you gave us.
• Your organization's data and the projects, budgets and unit price analyses you record.
• Technical security records, such as IP addresses and access dates, which may be processed by our infrastructure providers.

3. Purposes

We use your data to:

• Create and manage your account and provide the service.
• Send you service emails, such as account confirmation and password recovery.
• Protect the platform against abuse and unauthorized access.
• Keep backups that allow information to be recovered.
• Comply with legal obligations.

4. Authorization

We ask for your authorization in a prior, express and informed way when you create the account. We store it with its date and version.

You may revoke it at any time, except where a legal or contractual duty requires us to keep the data.

5. Your rights

Under Colombian Law 1581 of 2012, as a data subject you have the right to:

• Know, update and correct your data.
• Request proof of the authorization you gave us.
• Be informed about how we use your data.
• File complaints with the Superintendencia de Industria y Comercio.
• Revoke the authorization and request deletion of your data where applicable.
• Access your personal data free of charge.

6. How to exercise your rights

Write to us at datos@tessiqcost.com. We may ask for information to verify your identity.

We answer queries within 10 business days, extendable by 5 more business days, and complaints within 15 business days, extendable by 8 more business days, telling you the reason for any extension.

7. Providers and data transfers

To provide the service we use providers that process data on our behalf:

• Supabase: database and authentication, with servers in the United States.
• Cloudflare: application hosting, abuse protection and storage of encrypted backups.
• Resend: delivery of service emails.

8. Security and retention

We apply measures such as isolation of information between organizations, restricted access and encryption of backups.

We keep your data while your account is active and for as long as needed to meet legal obligations. Backups are kept for up to 14 days (daily) and 8 weeks (weekly).

9. Minors

The service is intended for adults. We do not knowingly process data of minors.

10. Changes to this policy

We will publish any change here. If it is substantial, we will ask for your authorization again.