Privacy Policy

Contents

1. Who is responsible for your data
2. Scope and legal framework
3. What data we collect
4. Why we use it
5. Your authorization
6. Who we share it with
7. International transfers
8. How long we keep it
9. Data we handle for our clients
10. Your rights
11. How to make a request
12. Security
13. Cookies and third-party services
14. Visitors from the EEA, UK and Switzerland
15. Children
16. Changes to this policy

1. Who is responsible for your data

The data controllers (Responsables del Tratamiento) are Marc Kakhia and Andrea Estupiñán, independent professionals (personas naturales) who provide consulting services together under the trade name Madjoy. In this policy, “Madjoy”, “we” and “us” refer to both of them.

Marc and Andrea handle requests about personal data themselves. You can send any request to either of the email addresses above, whichever of us it concerns (see section 11).

2. Scope and legal framework

This policy applies to personal data we process about:

• visitors to this website;
• people who contact us by email, WhatsApp, phone or in person;
• prospective and current clients, and the people who represent them;
• suppliers and professional contacts.

It is issued under Colombian Statutory Law 1581 of 2012 (Ley Estatutaria 1581 de 2012) and its regulations compiled in Decree 1074 of 2015 (Decreto Único Reglamentario 1074 de 2015), which incorporate Decree 1377 of 2013. Where the EU or UK General Data Protection Regulation applies to you, see alsosection 14.

This policy is available in Spanish and English. If the two versions differ, theSpanish version prevails.

When we handle personal data on behalf of a client during an engagement, the client is the controller and our role is described in section 9.

3. What data we collect

Information you give us

• Enquiries: your name, email address, company, role, phone number, the service you are interested in, and anything you write in your message.
• Engagements: contact details of client representatives, meeting notes, correspondence, proposals, agreements and the materials exchanged to deliver our services.
• Billing and payments: legal name, tax identification number (such as a NIT), billing address, and payment records. If you pay in digital currency (for example USDT or USDC), this includes the wallet address and transaction reference.

How the contact form works

The form on our Contact page does not send information to any server. When you press “Send Message”, it opens your own email application with a pre-filled message addressed to us (Marc, Andrea or both, depending on the service you choose). Nothing is stored by the website, and we receive your details only if you send that email.

Technical information

• Hosting and security: our website is hosted and delivered by Cloudflare. To serve pages and protect the site from abuse, Cloudflare processes technical data such as your IP address, browser type, the pages requested and the time of the request.
• Fonts: the website loads its typefaces from Google Fonts, which means your browser connects to Google's servers and shares your IP address with Google.

What we do not collect

• We do not use analytics, advertising or tracking tools on this website.
• We do not request sensitive data (datos sensibles), such as health, political, religious or biometric information. Please do not send it to us.
• We do not knowingly collect data from children or adolescents.

4. Why we use it

We process personal data only for these purposes (finalidades):

1. To answer enquiries and hold introductory conversations.
2. To prepare proposals, quotations and agreements.
3. To deliver and manage our services: coordinating meetings, sharing deliverables and reporting on progress.
4. To issue invoices, receive payments, keep accounts and meet tax obligations.
5. To comply with legal obligations and valid requests from competent authorities.
6. To operate the website and keep it secure.
7. To establish, exercise or defend legal claims.
8. With your consent, to send you occasional information about our services. You can opt out at any time.

We name clients or publish case studies only with the client's agreement. We will not use your data for purposes that are incompatible with those listed here without first telling you and, where required, obtaining your authorization.

5. Your authorization

Under Colombian law, processing personal data requires the data subject's prior, express and informed authorization. It may be given in writing, orally, or through conduct that clearly shows consent, such as writing to us after being informed of this policy. We keep a record of how authorization was obtained.

Authorization is not required in the cases set out in Article 10 of Law 1581 of 2012, including data of a public nature, requests from public authorities acting within their legal functions, and processing necessary to perform a contract with you. You may revoke your authorization at any time, unless we must keep the data because of a legal or contractual duty.

6. Who we share it with

We never sell, rent or trade personal data. We share it only with:

• Service providers acting on our behalf (encargados), such as our website hosting and content-delivery provider, email and productivity software, file storage, and messaging services. They may use the data only to provide their service to us.
• Professional advisors such as accountants and lawyers, who are bound by confidentiality.
• Banks and payment providers, to process payments.
• Competent authorities, when the law requires it.
• A company that takes over our activity, for example if we later incorporate Madjoy as a company. This policy would continue to protect your data, and we would tell you who the new controller is.

If you choose to contact us through WhatsApp, the conversation is also handled by WhatsApp (Meta) under its own terms and privacy policy.

7. International transfers

We work with clients in several countries, and some of our providers store data outside Colombia, for example in the United States. When personal data leaves Colombia, we rely on one of the following, as provided by Article 26 of Law 1581 of 2012 and Decree 1074 of 2015:

• the destination country provides an adequate level of protection, according to the Superintendence of Industry and Commerce (SIC);
• a contract with the provider that requires it to protect the data in line with this policy (a data transmission agreement);
• the transfer is necessary to perform a contract with you or to take steps at your request; or
• your express authorization.

8. How long we keep it

When these periods end, we delete the data or anonymize it so it no longer identifies you.

9. Data we handle for our clients

Some engagements give us access to personal data that belongs to our clients, for example customer records in a CRM or clienteling system, website and marketing accounts, or information gathered during a mystery shopping assessment. In those cases:

• the client is the data controller and we act as its processor (encargado);
• we process the data only on the client's documented instructions and for the purpose of the engagement;
• we keep it confidential and do not use it for our own purposes;
• we return or delete it when the engagement ends, unless the law requires otherwise.

Mystery shopping reports assess service standards and the customer experience. Where a report refers to individual staff members, it is shared only with the client under the engagement, and the client remains responsible for informing its staff in line with its own obligations.

10. Your rights

Under Article 8 of Law 1581 of 2012, you have the right to:

1. know, update and correct your personal data, including data that is partial, inaccurate, incomplete or misleading;
2. request proof of the authorization you gave us, except where authorization is not required;
3. be informed, on request, of how your data has been used;
4. revoke your authorization and/or request the deletion of your data when processing does not respect constitutional and legal principles, rights and guarantees, as long as we have no legal or contractual duty to keep it;
5. access your personal data free of charge;
6. file a complaint with the Superintendence of Industry and Commerce (SIC,www.sic.gov.co) once you have completed our query or claim procedure.

These rights may be exercised by you, your successors (causahabientes), your legal representative or an authorized attorney, with proof of identity or authority.

11. How to make a request

Send your request to [email protected] or [email protected] with the subject “Personal data request”, or in writing to our address in section 1. Please include your full name and identification, a clear description of your request, an address or email for our reply, and any supporting documents. We will verify your identity before acting on the request.

Queries (consultas)

We answer within ten (10) business days of receiving your query. If we cannot meet that deadline, we will tell you why and answer within five (5) further business days.

Claims (reclamos)

A claim is a request to correct, update or delete data, or a report that this policy or the law has not been respected.

• If your claim is incomplete, we will ask you to complete it within five (5) business days of receiving it. If you do not do so within two (2) months, the claim will be considered withdrawn.
• Once complete, we will mark the data concerned as “claim in progress” within two (2) business days.
• We will resolve the claim within fifteen (15) business days of receiving it complete. If we cannot, we will tell you why and resolve it within eight (8) further business days.

12. Security

We apply technical, human and administrative measures appropriate to the data we hold. These include limiting access to the people who need it, using reputable service providers that encrypt data in transit, and keeping client materials confidential. No system is completely secure. If a security incident affects your personal data, we will act promptly and notify you and the SIC when the law requires it.

13. Cookies and third-party services

This website does not set cookies and does not use analytics, advertising or tracking tools. Our hosting provider may use strictly necessary technical measures to protect the site against malicious traffic. If we ever introduce analytics or similar tools, we will update this policy first and ask for your consent where the law requires it.

The website links to services run by third parties, such as WhatsApp, and loads fonts from Google. Those companies process data under their own privacy policies, which we encourage you to read.

14. Visitors from the EEA, UK and Switzerland

If the General Data Protection Regulation (EU or UK GDPR) or the Swiss Federal Act on Data Protection applies to you, we process your data on these legal bases: to take steps at your request before entering into a contract, and to perform that contract; our legitimate interest in responding to business enquiries and keeping the website secure; compliance with legal obligations; and your consent, where we ask for it.

You also have the rights to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time. You may lodge a complaint with your local data protection authority. Your data is processed in Colombia and by providers in other countries; where no adequacy decision applies, transfers take place because they are necessary to respond to your request or perform our contract, or under appropriate contractual safeguards.

15. Children

Our website and services are intended for businesses and adults. We do not knowingly collect data from anyone under 18. If you believe a minor has sent us personal data, please contact us and we will delete it.

16. Changes to this policy

We may update this policy to reflect changes in the law or in how we work. The current version and its effective date are always shown at the top of this page. If we make a substantial change, particularly to the purposes for which we use data, we will announce it before it takes effect and, where required, ask for your authorization again.

This policy is effective from 27 September 2026. Personal data will be kept in our records for the periods described in section 8.