1. Parties and roles
The client acts as data controller and Izkuna S.A.S. acts as processor of the personal data required to deliver the contracted security services, in accordance with Colombian Law 1581 of 2012 and Decree 1377 of 2013. This agreement forms part of the Terms and Conditions.
2. Purpose and duration
The processor will process data only to perform the engagement, deliver reports, and comply with legal obligations, for the term of the contract and the applicable retention period.
3. Instructions and confidentiality
The processor will follow the controller's documented instructions and will not process data for its own purposes. Personnel with access are bound by confidentiality obligations.
4. Security
Reasonable technical and organizational measures apply: encryption in transit, password hashing, access control, audit logging, backups, and data minimization. Card data is never stored by Izkuna.
5. Sub-processors
The controller authorizes the following sub-processors for data processing:
| Provider | Purpose | Country |
|---|---|---|
| Render | Hosting and deployment | United States |
| Wompi / Bancolombia | Payments in Colombia | Colombia |
| Mercado Pago | International card payments | Argentina / Colombia |
| Google Workspace | Email and collaboration | United States |
The processor imposes equivalent obligations and will notify material changes.
6. Data subject rights
The processor will assist the controller in responding to access, rectification, deletion, or objection requests and will forward any requests it receives to the controller's contact.
7. Security incidents
The processor will notify the controller without undue delay and within 72 hours of confirming an incident affecting personal data, including available information and containment measures.
8. International transfers
Some providers are located outside Colombia. Appropriate contractual clauses and security measures apply. The controller may request additional information about the applicable safeguards.
9. Return and deletion
At the end of the contract, the processor will return or delete data at the controller's request, unless a legal retention obligation applies. Reports are retained for 5 years for professional liability purposes.
10. Audit and contact
The controller may request reasonable evidence of compliance with prior notice. Data protection contact: contact@izkuna.site.