IQ Risk S.A.S. Personal Data Processing Policy

1. Data controller

IQ Risk S.A.S., NIT (tax ID) 901.832.362-1, domiciled at Carrera 42 No. 3 Sur 81, torre 1 (tower 1), piso 15 (15th floor), Medellín (Antioquia), Colombia. Email for personal data matters: comercial@iqrisk.co. Phone: (+57) 300 837 5627.

2. Legal framework

This policy is adopted in accordance with Law 1581 of 2012 and Decree 1074 of 2015.

3. Purposes

To handle requests received through this site; to carry out the contracted risk management, occupational health and safety, and training services, which may include data of clients’ workers in assessments, training sessions and event investigations; to manage the commercial and contractual relationship; and to send information about our services when the data subject has authorized it. When a service requires sensitive data, such as health information, express authorization will be requested and providing it will be optional.

Data are kept for as long as necessary to fulfill these purposes and for the period required by legal, accounting and contractual obligations (generally up to ten years after the relationship ends, under Article 28 of Law 962 of 2005). Once that period has elapsed, the data are deleted or anonymized.

4. Rights of the data subject

To know, update, rectify and delete their data; to request proof of the authorization; to file complaints with the Superintendencia de Industria y Comercio (Colombia’s Superintendency of Industry and Commerce); and to revoke the authorization.

5. Inquiries and claims

Requests are received at comercial@iqrisk.co or by phone at (+57) 300 837 5627, stating the data subject’s name and ID, a description of the request and an address for the reply. Inquiries are answered within a maximum of ten (10) business days, extendable by five (5) additional business days, and claims within a maximum of fifteen (15) business days, extendable by eight (8) additional business days, in accordance with Articles 14 and 15 of Law 1581 of 2012. If a claim is incomplete, the claimant will be asked to complete it within the following five (5) days; if two (2) months pass without a response, the claim will be deemed withdrawn. The data subject may turn to the Superintendencia de Industria y Comercio only after exhausting this procedure with IQ Risk S.A.S.

6. Effective period

This policy has been in force since October 24, 2026 and will remain in force for as long as IQ Risk S.A.S. processes personal data. Material changes will be published on this page.