Privacy Policy

Makatea is Controller of your account data and Processor of your portfolio data. Data is hosted in the United States with encryption in transit and at rest. Makatea does not sell personal data. The policy covers Mexico, Latin America, the European Union, the United Kingdom, the United States and India. Rights are exercised free of charge at rodrigo@makatea.ai.

SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V. (hereinafter "Makatea", "we" or the "Controller"), a Mexican company with tax ID (RFC) SOB240719U87 and address at Avenida del Valle 162, Colonia Ciudad del Valle, C.P. 63157, Tepic, Nayarit, Mexico, operates the Makatea software as a service (SaaS) platform for customer communication, collections and portfolio management.

This Policy applies in every country where Makatea provides the Service. The country sections (Section 12) cover Mexico, Colombia, Brazil, Ecuador, Peru, the European Union and Spain, the United Kingdom, the United States and India. They supplement this Policy and, where applicable, prevail for the data subjects of each country. In other countries, this Policy and the local data protection law apply.

1. Identity and address of the Controller

• Legal name: SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V.
• Tax ID (RFC): SOB240719U87 (Mexican company, incorporated on July 19, 2024)
• Address: Avenida del Valle 162, Colonia Ciudad del Valle, C.P. 63157, Tepic, Nayarit, Mexico
• Sole establishment: Mexico
• Privacy contact email: rodrigo@makatea.ai
• Contact phone: +52 81 2007 2062

Single privacy contact and Data Protection Officer (DPO, Encarregado in Brazil): José Rodrigo Barrios Villa, rodrigo@makatea.ai. This is the single channel for all jurisdictions and for data subjects to exercise their rights.

2. Makatea's two roles: Controller and Processor

Makatea processes personal data in two different roles, and it is important to tell them apart.

2.1. ACCOUNT data of the customer-user · Makatea acts as CONTROLLER

For the data of the people who create and manage a Makatea account (users of customer organizations: account owners, administrators and members), Makatea acts as data Controller (controlador under Brazil's LGPD).

2.2. PORTFOLIO data of third parties · Makatea acts as PROCESSOR

For the personal data of the customers, debtors or end contacts that the customer organization imports, uploads and manages in the platform (the "portfolio"), Makatea acts as data Processor, on behalf of and following the instructions of the customer organization, which is the Controller of that data.

This means that:

• The customer organization determines the purposes and means of processing its portfolio data. It is responsible for having the lawful basis and the consent (where applicable) to process that data and to upload it to Makatea, and for handling the rights of its own customers and debtors.
• Makatea processes that data only to provide the contracted service (portfolio management, communication, collections, payment reconciliation), following the customer organization's instructions, and does not use it for its own different purposes. The only exception is generating reports and insights requested by the organization itself, for which aggregated or derived portfolio data is processed (see Sections 4.1, 6 and 10).
• The Controller-Processor relationship is governed by a data processing agreement (DPA) between Makatea and the customer organization, which sets out the Processor role and includes security, confidentiality, rights handling and sub-processing clauses. The DPA is accepted electronically when accepting the Terms of Service (click-wrap) and is incorporated by reference. It does not require a handwritten signature or a separate signing step. The customer organization (Controller) accepts the DPA when it signs up and subscribes. The DPA text is public at https://makatea.ai/en/legal/dpa.

If you are an end customer or debtor whose data was uploaded to Makatea by a company you have a relationship with, and you want to exercise your rights, contact that company first (the Controller). Makatea will forward and handle requests as Processor, on the Controller's instructions.

3. Personal data we process

3.1. Account data of the customer-user (Makatea = Controller)

Collected directly from the user at sign-up and while using the platform:

• Full name
• Email (account identifier, used for sign-in, password recovery and email verification)
• Phone
• Password (always stored hashed, never in plain text)
• Organization name
• Time zone and language preference (es/en/pt)
• Marketing consent (opt-in flag showing whether the user agrees to receive promotional communications from Makatea)
• Terms acceptance timestamp
• Role within the organization
• Audit records linked to the user's actions, including IP address, user agent (browser or device) and timestamp of actions in the platform (create, update, delete, sign-in, import, send, payment record)
• Browser push notification subscriptions (endpoint and browser encryption keys), when the user turns them on
• Browsing data collected on the public site through cookies and similar technologies: pseudonymous browser identifier, IP address, browser and device type, operating system, language, approximate city-level location, visit source (referrer or campaign), pages viewed and access times

Measurement cookies. The public site uses traffic measurement cookies for statistics. They are linked to a pseudonymous browser identifier, not to your name or email. They show which pages are viewed and where visitors come from. In the European Union, the European Economic Area and the United Kingdom they are turned on only if you accept them in the cookie notice. In other countries they are turned on when the site loads and are disclosed in this Policy. You can block or delete them from your browser without affecting your use of the platform. Details are in the Cookie Policy, https://makatea.ai/en/legal/cookies.

Mandatory or optional account data. In the sign-up form, the data needed to create and run the account is mandatory: name, email, password and organization name. Phone, language or time zone preference and marketing consent are optional. If the mandatory data is not provided, the account cannot be created and the service cannot be provided.

3.2. Portfolio data of third parties (Makatea = Processor)

Uploaded by the customer organization about its own customers or debtors. Makatea stores and processes it on behalf of the Controller.

Identification and contact data of the third party:

• Full name (mandatory)
• Phone (normalized for messaging; the operating channels are WhatsApp and email)
• Email (optional)
• Address
• National or tax identification data, by country, including CURP and RFC in Mexico (stored in an identity field)
• External reference (the third party's identifier in the customer's source system)
• Custom fields freely defined by the customer organization
• Tags and free-text notes

Financial and portfolio data of the third party:

• Opening balance at import and initial status in the source system
• Payment orders: amount, currency, due date, period label, status (pending, overdue, paid, cancelled), amount paid
• Credits and payment schedules: principal, total amount, number and frequency of periods, start date, status
• Payment ledger: amount, payment method (transfer, cash, QR, external), payment reference or proof, user who recorded the payment, timestamp, notes and reversal records
• Payment proofs (type, reference, who confirmed and when, notes)
• Relationship status derived from portfolio behavior (active, at risk, overdue, inactive, churned), calculated by the system and not editable by hand

Identity and KYC data of the third party (documents):

• Identity documents and proof of address (for example, front and back of official ID, proof), stored in private storage, with type, status (ok or missing) and description

Sensitive nature, special categories and financial data. Some of this data may be economic or financial data (balances, debts, proofs) and enhanced identification data. In several jurisdictions this data requires enhanced lawful bases or express consent. Obtaining that consent or lawful basis from the third parties is the responsibility of the customer organization (Controller), not of Makatea. When Makatea processes financial or economic data as Controller (user account data), it collects the documented express consent that applies (see Sections 5 and 12.1).

Bank reconciliation data of the third party:

• Fixed bank payment reference, source CLABE and payer aliases learned from transactions, lines of bank files (payer name, CLABE, date, reference, amount)

Communication and interaction data:

• Full text of messages (inbound and outbound), channel (WhatsApp and email), direction (inbound or outbound), classification of the message intent (for example, payment intent, question, objection, rescheduling, opt-out, no intent), classification metadata (rule or model, version, confidence, latency), timestamp and, where applicable, URL of the attached media file
• Sequence and campaign data (when and why each message was scheduled or sent)
• Consents and opt-outs: channels the third party opted out of and the record of opt-out requests ("stop messaging me"), kept as part of the history

Communication channels. The operating sending channels are WhatsApp and email. Makatea does not run SMS as a sending channel.

No card data. Card payment processing takes place in environments hosted by payment processors. Card data is not processed or stored by Makatea (see Section 6).

4. Purposes of processing

4.1. Account data (Makatea = Controller)

• Creating, authenticating and managing the user's account and organization (sign-up, sign-in, email verification, password recovery, invitations)
• Providing, maintaining and supporting the contracted service
• Managing roles, permissions and data isolation by organization
• Keeping audit and security records of the platform
• Measuring public site traffic for statistics: pages viewed, visit sources and aggregated browsing behavior, to improve content and service
• Monitoring the operating health of each organization's service (connection status of its channels, sending and receiving volumes, pending message queues, delivery errors and last activity dates). This monitoring uses only operating metadata. It never involves Makatea staff accessing message content or the organization's portfolio personal data
• Producing reports and aggregated information for the organization (including weekly reports with AI-generated narrative based on aggregated or derived metrics, not on full individual records)
• Marketing (only if the user gave opt-in consent): sending promotional communications from Makatea. This purpose is not necessary for the service and can be revoked at any time.

4.2. Portfolio data of third parties (Makatea = Processor)

Makatea processes this data only on behalf of and on the instructions of the customer organization, to:

• Store and organize the customer organization's portfolio
• Send collection communications, reminders and campaigns to the organization's contacts, through the configured channels
• Record and classify interactions; learn contact preferences (preferred channel, best time, response rate) to improve communication
• Record payments and reconcile the portfolio (including bank reconciliation)
• Manage identity and KYC documents uploaded by the organization
• Keep traceability and audit records of operations on the portfolio

Makatea does not use portfolio data for its own purposes and does not sell it. It only processes aggregated or derived data to produce the reports and insights requested by the organization itself (see Section 6 about the AI sub-processor).

5. Lawful basis for processing

The lawful basis varies by role, data and jurisdiction. The following table is general. The breakdown by specific operation required by the Peruvian standard follows.

Lawful basis by operation (Peruvian standard, S.D. 016-2024-JUS; also applied as good practice):

Clarification (third-party portfolio). Where the table says "Controller's instruction (Makatea as Processor)", it describes Makatea's role as processor, not a lawful basis in itself. The lawful basis for each portfolio operation (consent, performance of contract, legitimate interest or legal obligation) is determined and stated by the customer organization (Controller) in its own privacy notice, under the law of its jurisdiction. Makatea processes that data only following those instructions.

The particulars of each jurisdiction (for example, prior, express and informed authorization in Colombia; the cases of art. 7 LGPD in Brazil; the cases of art. 7 LOPDP in Ecuador; free, prior, express, informed and unequivocal consent in Peru; express consent for sensitive or financial data in Mexico; the bases of art. 6 GDPR in the European Union and the United Kingdom) are detailed in Section 12.

6. Transfers, processors and sub-processors

To provide the service, Makatea uses technology providers that act as processors or sub-processors. The sub-processors and the data they receive are listed below. Some involve an international data transfer. Each sub-processor processes data under its own terms and data processing agreements or standard contractual clauses, which apply when using its service and are incorporated by reference.

The list by function and country is published at https://makatea.ai/en/legal/subprocessors. The identity of each sub-processor, its location and the transfer mechanism are made available to the data subject or the Customer on request, through the contact channel in this Policy.

WhatsApp messaging runs on Makatea's own infrastructure hosted in the United States. It is not an independent third-party sub-processor but infrastructure of the platform itself. Hosting that data in the United States is an international transfer, subject to the safeguards described in this Section.

Nature of the transfers. When Makatea hosts or processes portfolio data at providers outside the data subject's country, it does so as Processor, on behalf of the Controller. International transfers to the United States are made under the standard contractual clauses incorporated in each provider's terms, according to the variants each jurisdiction recognizes: in Brazil, the ANPD standard clauses (Res. CD/ANPD 19/2024); in Colombia, the international transmission regime (Decree 1377, art. 25); in Ecuador, the standard clauses (Res. SPDP-SPD-2026-0004-R) together with the transfer register; in Peru, the applicable appropriate safeguards; and in the European Union and the United Kingdom, the European Commission's standard contractual clauses and their UK addendum. These transfers are disclosed to the data subject through this Policy.

We do not sell or rent personal data. Makatea does not trade in personal data. The sub-processors listed in this Section 6 receive data only to provide the service, under data processing agreements. Data is not shared with third parties for purposes other than providing the service. Sending aggregated metrics and the organization name to the language-model analysis sub-processor in the United States is processing by a processor abroad, subject to the international transfer safeguards described here.

Personal data is not exported to external analytics or CRM services other than the sub-processors listed in this Section 6.

7. Data retention

• The main tables use a logical deletion (soft-delete) pattern in preference to physical deletion: members are marked as churned and orders as cancelled, without cascading deletion.
• Interaction, payment (ledger) and audit records are append-only at the application level (only added, not updated or deleted in normal operation). They keep the full history, including reversals recorded as new events.
• Audit records keep snapshots of data before deletion (for example, name, phone, amount, status).

Retention and deletion criteria and periods by data category:

When an organization account is cancelled or deleted, personal data is deleted or anonymized unless there is a legal retention obligation (for example, tax or accounting), in which case it is kept only for the period and purpose that obligation requires.

Backups. Backups are managed by the database provider's infrastructure in the United States and are subject to its own retention periods and to the encryption at rest described in Section 8.

For third-party portfolio data, retention periods are set by the customer organization (Controller), according to its legal obligations (for example, accounting or tax) and the instructions it gives Makatea.

8. Security measures

Makatea applies the following technical and administrative measures:

• Encryption in transit (HTTPS/TLS) on all endpoints and network calls.
• Data isolation by organization at the database level in all main tables. Each organization accesses only its own data. Makatea reviews this isolation continuously.
• Private storage for KYC documents, media and reconciliation files, with access restricted to the owning organization.
• Protection of integration secrets. Integration keys (for example, messaging and payment processor keys) are stored encrypted or with restricted access and are not accessible to the organization's users.
• An audit log that captures user, action, resource, before and after values, IP address, user agent and timestamp. The platform only appends events to this log and offers no operations to edit or delete them.
• Atomic transactional functions for payment operations, protected against race conditions.
• Restricted staff access. Authorized Makatea staff access data only as needed to operate and support the platform and are bound by confidentiality agreements over the personal data processed.

Encryption at rest. Data at rest is encrypted with AES-256 on the cloud infrastructure that hosts it, and payment data is processed in the payment processors' PCI-DSS environments.

Security breach notification. If a security breach affects personal data, Makatea, as Controller or Processor as applicable, notifies the Controller, the affected data subjects and/or the supervisory authority as required by applicable law (art. 19 LFPDPPP Mexico; art. 48 LGPD Brazil; Ecuador obligations; 48 hours to the APDP in Peru; articles 33 and 34 GDPR in the European Union and the United Kingdom; see Section 12). The notice includes a description of the incident, the data affected, the measures taken and recommendations for the data subject.

9. Data subject rights and how to exercise them

9.1. If you are an account user (Makatea = Controller)

You can exercise your rights directly with Makatea, according to your jurisdiction (see Section 12 for the full list and periods by country):

• Access to your data (all jurisdictions)
• Rectification or updating of inaccurate or incomplete data (all jurisdictions)
• Cancellation, erasure or deletion of your data, with prior blocking where the law provides it (all jurisdictions)
• Objection to processing, including objection to automated processing or profiling (in Mexico, within the right to object of art. 26-II LFPDPPP) (all jurisdictions)
• Withdrawal of consent (for example, marketing) at any time, without retroactive effect (all jurisdictions)
• Restriction or suspension of processing, a right of Brazil, Ecuador, Peru, the European Union and the United Kingdom. It is not a standalone right in Mexico under the LFPDPPP (in Mexico it is handled through cancellation with blocking of art. 24 and objection of art. 26)
• Portability, a right of Brazil (art. 18 LGPD), Ecuador (art. 20 LOPDP), Peru, the European Union and the United Kingdom (art. 20 GDPR). It is not a standalone right in Mexico under the LFPDPPP
• Not being subject to automated decisions with significant legal effects. In Mexico it is exercised through objection under art. 26-II. In Brazil, Ecuador, the European Union and the United Kingdom it is an express right (art. 20 LGPD, art. 22 LOPDP, art. 22 GDPR)

For Mexico, the rights you can exercise with Makatea are the ARCO rights (access art. 22, rectification art. 23, cancellation with blocking art. 24, objection art. 26, including objection to automated processing of art. 26-II) and withdrawal of consent (art. 7). Portability and restriction are not standalone rights under Mexico's LFPDPPP. They apply in other jurisdictions (see Section 12).

Deletion and export on request. On request through the single channel, Makatea offers: (a) effective deletion or anonymization of your personal data (including, where applicable, the handling of append-only records and backups), unless there is a legal retention obligation; and (b) export of your data in a structured, machine-readable format (access and portability). These requests are handled through the single privacy channel.

How to exercise them: send your request to rodrigo@makatea.ai, identifying yourself and stating the right you want to exercise. Exercising these rights is free. Response periods by country are in Section 12.

Functions available in the platform:

• CSV export (UTF-8): the interface lets you export reports, reconciliation and templates in aggregated form. This function is aggregated and at the organization level. It is not the same as the individual access or portability export per data subject, which is handled on request through the single channel (see above).
• Rectification: editing member and order data from the interface.
• Cancellation: churning members and cancelling orders. Effective deletion or anonymization is handled on request through the single channel.

9.2. If you are a customer or debtor in a portfolio (Makatea = Processor)

Your rights are exercised with the organization (company) that uploaded your data to Makatea, which is the Controller. If you send your request to Makatea, we forward it to the Controller and handle it according to its instructions and applicable law, as Processor.

To opt out of communications, you can reply to any message saying you do not want to receive more. The system records that opt-out and the channels you opted out of.

10. Automated decisions and profiling

The platform automatically classifies interactions (for example, payment intent, objection, opt-out) using rules or models, and derives the third party's relationship status (active, at risk, overdue, inactive, churned) from portfolio behavior. It also learns contact preferences (channel, best time, response rate). These functions support the customer organization's collection and communication operations.

Logic applied and consequences:

• Interaction classification assigns an intent label to the message, using rules or a model, with a confidence value. It is used to prioritize and guide the operator's response.
• The relationship status is derived automatically from payment and contact behavior and guides the organization's communication strategy.
• Learning contact preferences adjusts the sending channel and time to improve communication.

Right to review and not to be subject to automated decisions. These functions are designed to support the decisions of the customer organization's human operator, not as fully automated decisions that by themselves produce legal or significant effects on the data subject. In any case, the data subject can request human intervention and review of those classifications from the Controller.

11. Changes to this Policy

Makatea may change this Privacy Policy. Any change is communicated before it takes effect by: (i) publishing the updated version on the platform or website with the last update date highlighted, and (ii) notifying the account holder at the registered email. For material changes that require new consent, consent is requested before applying the processing. Continued use of the service after the changes take effect means you are aware of them, without prejudice to the data subject's rights.

12. Country sections

12.1. Mexico (MX) · LFPDPPP

• Framework: Federal Law on the Protection of Personal Data Held by Private Parties (in force since March 21, 2025; 2011 Regulation applies on a supplementary basis). Authority: Secretaría Anticorrupción y Buen Gobierno (SABG).

• Type of notice: full.

• Short privacy notice (art. 16): at the point of collection (sign-up form and any capture point) the following text is shown:

  Short Privacy Notice. SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V. (the "Controller"), with address at Avenida del Valle 162, Colonia Ciudad del Valle, C.P. 63157, Tepic, Nayarit, Mexico, will process your personal data to create and manage your account, provide the contracted service and, if you authorize it, send you promotional communications. Some purposes may require your express consent (for example, processing financial or economic data) and may involve transfers to providers abroad. You can limit the use or disclosure of your data and withdraw your marketing consent by writing to rodrigo@makatea.ai or through the unsubscribe link in our communications (art. 15-IV). You can learn about the purposes that require your consent and the third-party recipients, and exercise your ARCO rights, by reading the Full Privacy Notice (this document), available at https://makatea.ai or by requesting it at rodrigo@makatea.ai.

• Sensitive and financial data: processing financial, economic and sensitive data requires express consent (arts. 7 and 8). When Makatea processes this data as Controller, it collects and documents that express consent. For the portfolio, that consent must be obtained by the customer organization (Controller).

• ARCO rights + withdrawal (arts. 22-26): Access (art. 22), Rectification (art. 23), Cancellation (art. 24, with a blocking period before deletion), Objection (art. 26, including objection to profiling or automated processing, art. 26-II) and withdrawal of consent (art. 7). The LFPDPPP does not recognize standalone portability or restriction rights in the LGPD or GDPR style. Those rights apply in other jurisdictions.

• Ways to limit use or disclosure (art. 15-IV): you can request limits on the use or disclosure of your data by writing to rodrigo@makatea.ai. For marketing, you can withdraw consent at any time through the same channel or the unsubscribe link in communications.

• Procedure to withdraw consent (art. 7): to withdraw, the data subject sends a request to rodrigo@makatea.ai identifying themselves (name and account email) and stating the consent being withdrawn. Makatea handles the request within the periods of art. 31 (20 business days to respond; 15 business days to carry it out). Withdrawal takes effect going forward, without retroactive effect, on the processing covered by that consent. There are two cases: (i) withdrawal of marketing consent, which can also be done through the unsubscribe link and does not affect the service; and (ii) withdrawal of the express consent to process financial or economic data that Makatea processes as Controller, which may limit or prevent the purposes that depend on that data.

• Periods: 20 business days to respond and 15 business days to carry out the right (art. 31). Free of charge (art. 34).

• Transfer clause with option to refuse (art. 35): this notice informs you that your data may be transferred to the third parties or sub-processors listed in Section 6. If you do not want your personal data transferred for purposes not necessary for the relationship, you can say so by writing to rodrigo@makatea.ai. Not refusing is understood as accepting the transfers described. Processing by a Processor is not a transfer (art. 2). Appeal before the SABG (arts. 38-39).

• Appointment of a personal data officer or department (art. 29): single privacy contact, José Rodrigo Barrios Villa, rodrigo@makatea.ai. There is no mandatory national database registry in Mexico.

• Breach notification (art. 19): Makatea notifies the affected data subject, without delay, of security breaches that significantly affect their economic or moral rights, so they can take measures.

12.2. Colombia (CO) · Law 1581 of 2012 and Decree 1377 of 2013

• Framework: Habeas Data regime. Authority: Superintendencia de Industria y Comercio (SIC).

• Processing Policy (Decree 1377, art. 13): this document includes the Controller's name, address and contact; the processing and its purpose; the data subject's rights; the procedure to exercise rights; the area responsible for petitions, inquiries and claims; and the effective date.

  • Area or person responsible for petitions, inquiries and claims (item 4): single privacy channel, rodrigo@makatea.ai.
  • Effective date (item 6): June 15, 2026. Term of the database: processing continues while the relationship with the customer organization lasts and according to the retention periods in Section 7.

• Collection Privacy Notice (Decree 1377, arts. 14-15): separate from this full Policy, it is delivered no later than when the data is collected. Makatea delivers it to the account holder at sign-up (where Makatea is Controller). For third-party portfolios, Makatea acts as Processor and has no direct channel with those data subjects during bulk import. The duty to deliver the collection notice and to obtain and keep proof of authorization, including the duty of art. 10 of Decree 1377 for data collected before it took effect, belongs to the customer organization (Controller). This obligation is passed to the Customer as an instruction and warranty in the DPA. Short notice text that Makatea gives the account holder:

  Privacy Notice. SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V. will process your personal data to create and manage your account, provide the service and, with your authorization, send commercial communications. You have the right to know, update, rectify and delete your data and to revoke the authorization. For sensitive data, your authorization is optional. See the full Processing Policy at https://makatea.ai or request it at rodrigo@makatea.ai.

• Authorization (art. 9; Decree 1377, arts. 5-9): prior, express and informed. Makatea (as Processor) and the customer organization (Controller) keep proof of the authorization.

• Sensitive data (Decree 1377, art. 6): you are expressly informed that, because it is sensitive data, you are not required to authorize its processing. Makatea, as Processor, does not request sensitive data in a structured way. However, sensitive data could be entered in the custom fields, tags, free-text notes and identity or KYC documents that the customer organization (Controller) uploads, whose sole purpose is the portfolio management, communication and collection instructed by the Controller. Authorization for sensitive data is explicit and separate and is obtained by the Controller from its data subjects.

  • Note on financial data in Colombia: financial, credit and portfolio data is not "sensitive data" under art. 5 of Law 1581. Its processing is governed by Law 1266 of 2008 (financial Habeas Data). The separate authorization regime for sensitive data therefore does not apply to financial portfolio data, without prejudice to the Law 1266 regime that the Controller must follow.

• Warning to the Customer, Law 1266 of 2008 (financial and commercial Habeas Data): Law 1266 of 2008 sets a regime separate from Law 1581 of 2012 and Decree 1377 of 2013. If the customer organization (Controller) uses the platform to report, manage or administer negative financial, credit, commercial or service information about its debtors (for example, for credit bureaus or financial databases), it may be subject to Law 1266 of 2008 as a "source" or "operator" of information. That imposes specific duties, among them data accuracy and quality, timely updating and rectification, prior notice to the data subject before reporting negative data and the rules on expiry and permanence of negative data, as well as respect for the enhanced rights that law recognizes. Makatea only provides the management and communication software. It does not operate or manage credit bureaus or financial information databases and does not act as source, operator or user under Law 1266.

• Data subject rights (art. 8): know, update, rectify; request proof of authorization; be informed of the use given to their data; file complaints with the SIC; revoke authorization and/or request deletion; access their data free of charge.

• Periods: inquiries, 10 business days (extendable by 5); claims, 15 business days (extendable by 8); "claim in progress" marking.

• Inquiry procedure (art. 14 Law 1581): the data subject or their successors can consult the information in the database by writing to rodrigo@makatea.ai. The inquiry is answered within 10 business days of receipt at most. If that is not possible, the reasons for the delay and the answer date are given, which will not exceed 5 business days after the first period ends.

• Claims procedure (art. 15 Law 1581): the claim is sent to rodrigo@makatea.ai in writing with: (i) identification of the data subject (name and document), (ii) description of the facts, (iii) address for notices and (iv) supporting documents. If the claim is incomplete, the claimant is asked to complete it within 5 days. If 2 months pass from that request without completion, the claim is considered withdrawn. Once the complete claim is received, the legend "claim in progress" and the reason are added to the database within 2 business days and kept until the claim is decided. The maximum period to resolve the claim is 15 business days from receipt. If that is not possible, the reasons and the answer date are given, which will not exceed 8 business days after the first period ends.

• Prior exhaustion (art. 16 Law 1581): the data subject can file a complaint with the SIC only after completing the inquiry or claim process with Makatea (or the Controller, as applicable).

• Transfer vs. international transmission: because Makatea acts as Processor and hosts data at providers abroad, this is an international transmission, covered by the transmission regime (Decree 1377, art. 25) incorporated in each sub-processor's terms, which requires Makatea to apply the Controller's policy, confidentiality, security and handling of inquiries and claims.

• RNBD (National Database Registry): registration is mandatory only for companies or non-profits with assets above 100,000 UVT and public legal entities (Decree 090 of 2018). Where Makatea's effective operations in Colombia make this registry applicable, the registration will be assessed and completed.

• DPO: the single privacy and PQR channel is rodrigo@makatea.ai.

12.3. Brazil (BR) · LGPD (Law No. 13,709/2018)

• Framework: General Personal Data Protection Law. Authority: ANPD. CD/ANPD Resolutions No. 18/2024 (Encarregado) and No. 19/2024 (International Transfer).
• Roles: Makatea acts as controller of the registration and billing data of the customer-user's account and as operator of the data the customer uploads to the platform (third-party portfolio), following the controller's instructions (art. 39, DPA).
• Legal bases (art. 7): in B2B the main ones are performance of contract (art. 7, V), compliance with a legal obligation (art. 7, II) and legitimate interest (art. 7, IX). Consent (art. 7, I) applies to marketing.
• Form and duration of processing (art. 9, II): retention and deletion criteria and periods by data category are in Section 7.
• Data subject rights (art. 18): confirmation of processing; access; correction; anonymization, blocking or deletion of unnecessary, excessive or non-compliant data; portability; deletion of data processed on consent (except art. 16); information about sharing; information about the option not to consent and its consequences; withdrawal of consent; and review of automated decisions (art. 20), see Section 10.
• International transfer (art. 33; Res. 19/2024): made to the United States under the standard contractual clauses approved by the ANPD (Res. CD/ANPD 19/2024), incorporated in the terms of the sub-processors in the United States and in Makatea's messaging infrastructure.
• Encarregado (DPO), art. 41, §1-§2; Res. 18/2024: appointed Encarregado José Rodrigo Barrios Villa; public contact channel rodrigo@makatea.ai. (The LGPD does not require residence in Brazil.)
• Record of processing operations (RoPA, art. 37) and incident notification to the ANPD and data subjects (art. 48), as required by applicable law.
• Automated decisions (art. 20): see Section 10. The right to request review is guaranteed.

12.4. Ecuador (EC) · LOPDP

• Framework: Organic Law on Personal Data Protection and its Regulation (Decree 904/2023); SPDP Resolutions on the Delegate (2025-0028-R) and Transfers (SPDP-SPD-2026-0004-R). Authority: Superintendencia de Protección de Datos Personales (SPDP).
• Prior information (arts. 12-13): identity and contact of the Controller; specific purposes; lawful basis (art. 7); data categories (warning about sensitive data); source when not obtained from the data subject; recipients; transfers and destination country with safeguards; retention periods (Section 7); automated decisions or profiling and their logic (art. 22, Section 10).
• Retention periods and criteria (art. 12): stated by data category in Section 7.
• Automated decisions and profiling (art. 22): the platform classifies interactions, derives relationship status and learns contact preferences. Their logic, significance and consequences, and the right not to be subject to automated decisions and to request human review, are described in Section 10.
• Rights: information (arts. 12-13), access (art. 16), rectification and updating (art. 17), deletion including the right to be forgotten (art. 18), objection (art. 19), portability (art. 20), suspension or restriction (art. 21), not being subject to automated decisions (art. 22), consulting the National Registry, and complaint to the SPDP. Free of charge; general response period of 15 days, extendable. Effective deletion or anonymization and export of the data subject's data are handled on request through the single channel (see Section 9.1).
• Processor role: for the portfolio, Makatea is processor and there is a processing contract (DPA) with the obligations of arts. 38 and following. The DPA text is at https://makatea.ai/en/legal/dpa and is accepted electronically when subscribing.
• International transfers (Res. SPDP-SPD-2026-0004-R): made to the United States under standard clauses incorporated in the sub-processors' terms, keeping the corresponding transfer register. Andean Community states are considered equivalent.
• Data Protection Delegate (art. 47; Res. 2025-0028-R): Data Protection Delegate in Ecuador, José Rodrigo Barrios Villa, rodrigo@makatea.ai. Registration of the Delegate with the SPDP is assessed and completed according to Makatea's effective operations in Ecuador and the requirement by scale or sector.

12.5. Peru (PE) · Law 29733 and Regulation S.D. 016-2024-JUS

• Framework: Personal Data Protection Law and its Regulation. Authority: APDP, National Authority for Personal Data Protection (MINJUSDH). Applies extraterritorially to foreign companies offering services to people in Peru.
• Duty to inform (art. 18): identity and address of the Controller; specific purposes; lawful basis of each processing operation (breakdown in Section 5); mandatory or optional nature of the data and consequences of not providing it (stated in Section 3.1); recipients; cross-border flows and safeguards; retention periods (Section 7); identification of the database and its registration in the RNPDP; DPO details when mandatory.
• Rights and procedure: information (art. 18), access (art. 19), rectification (art. 20), cancellation or deletion (art. 20), objection (art. 21), objective processing (not being subject to decisions based only on automated processing or profiling, Section 10) and portability (when processing is based on consent or contract by automated means). Protection before the APDP. Free procedure.
  • Channel and periods: requests are sent to rodrigo@makatea.ai. Periods by right under Regulation S.D. 016-2024-JUS: access (art. 19), 8 business days (extendable); rectification (art. 20), 10 business days (extendable); cancellation or deletion (art. 20), 10 business days (extendable); objection (art. 21), 10 business days (extendable).
• Consent: free, prior, express, informed and unequivocal. For sensitive data, in writing or an equivalent means.
• Transfer and cross-border flow: made to the United States under appropriate safeguards (standard clauses) incorporated in the sub-processors' terms. The burden of proof lies with the exporter (Makatea or the Controller).
• Database Registry (RNPDP): registration of databases in the RNPDP is assessed and completed according to Makatea's effective operations in Peru. The code of each database will be stated once obtained.
• Personal Data Officer (DPO): mandatory for large-scale processing of sensitive data or large-scale systematic monitoring, phased in by sales level. Whether the formal role is mandatory is assessed according to Makatea's scale of operations in Peru. Data contact channel: rodrigo@makatea.ai.
• Security incidents: notification to the APDP within 48 hours of detection (and to affected data subjects where applicable), with the minimum legal content.

12.6. European Union and Spain · GDPR

• Framework: Regulation (EU) 2016/679 (GDPR). In Spain, also Organic Law 3/2018. Authority in Spain: Agencia Española de Protección de Datos (AEPD). In other EU countries, each country's authority.
• Legal bases (art. 6): performance of contract for the account, legitimate interest for security and audit, legal obligation for tax records and consent for marketing and measurement cookies.
• Rights (arts. 15 to 22): access, rectification, erasure, restriction, portability, objection and not being subject to decisions based solely on automated processing. Exercise is free and requests are answered within one month, extendable by two months in complex cases.
• Portfolio: the customer organization is Controller and Makatea is Processor under art. 28, on the terms of the DPA and its EU and UK annex.
• Transfers to the United States (arts. 44 to 49): covered by the standard contractual clauses approved by the European Commission, incorporated in each provider's terms.
• Representative (art. 27): Makatea has no establishment in the EU. It appoints a representative when its operations in the EU require it. Until then, the single privacy channel handles all requests.
• Complaints: the data subject can file a complaint with the AEPD or the authority of their country.

12.7. United Kingdom · UK GDPR

• Framework: UK GDPR and Data Protection Act 2018. Authority: Information Commissioner's Office (ICO).
• Rights, legal bases and roles: the same as Section 12.6.
• Transfers: covered by the UK addendum to the European Commission's standard contractual clauses.
• Representative: Makatea appoints one when its operations in the United Kingdom require it.

12.8. United States

• State privacy laws apply according to the data subject's state of residence and the size of each business.
• Makatea does not sell personal data or share it for targeted advertising.
• Data subjects can exercise through the single channel the rights their state law grants them.

12.9. India · DPDP Act 2023

• Framework: Digital Personal Data Protection Act, 2023, as it comes into force in phases.
• Roles: for the portfolio, the customer organization is Data Fiduciary and Makatea is Data Processor.
• Rights: access to information, correction and erasure, grievance redressal and nomination of a person. They are exercised through the single channel.

13. Contact

For any question about this Policy or to exercise your rights:

• Controller: SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V. (RFC SOB240719U87)
• Privacy and rights email: rodrigo@makatea.ai
• Phone: +52 81 2007 2062
• Address: Avenida del Valle 162, Colonia Ciudad del Valle, C.P. 63157, Tepic, Nayarit, Mexico
• DPA (data processing agreement): https://makatea.ai/en/legal/dpa
• Single privacy contact, DPO and Encarregado (BR): José Rodrigo Barrios Villa, rodrigo@makatea.ai (single channel for all jurisdictions).

You can also file complaints with the supervisory authority of your country, for example the SABG (Mexico), SIC (Colombia), ANPD (Brazil), SPDP (Ecuador), APDP (Peru), AEPD (Spain) or ICO (United Kingdom).

14. Governing law and jurisdiction

This Privacy Policy is governed by the laws of the United Mexican States. For the interpretation and performance of this Policy, and for any dispute arising from it, the parties submit to the courts of Tepic, Nayarit, Mexico, without prejudice to the rights that the applicable law of each jurisdiction grants data subjects and to the competence of the supervisory authorities listed in Section 13.

15. Language

This Policy is published in Spanish, English and Portuguese. If versions differ, the Spanish version prevails, unless the data subject's law requires otherwise.