Política de privacidad

Privacy Policy – BPENNOVA Consulting Group

1. Introduction and data controller

This Privacy Policy explains what personal data BPENNOVA Consulting Group collects, how it uses it, with whom it shares it and what rights you have over it. It is effective as of October 9, 2026.

BPENNOVA Consulting Group ("BPENNOVA") provides financial and process automation services to companies in Chile, Mexico and Colombia. This policy applies to our website www.bp-ennova.com, to the forms we offer on it, to our commercial communications, to the events we take part in and to the other activities described here (together, the "Service").

Our role. We are the controller of the data of site visitors, business contacts, clients and candidates. When we process personal data included in the information a client company provides to us in order to deliver the service (for example, data on legal representatives, shareholders or employees appearing in financial statements and their notes), we act as processor on behalf of that company, which is the controller, and we process that data only according to its instructions and the service agreement.

Notice for users in Chile, Mexico and Colombia. See section 8 to learn about the rights granted to you by the law of your country and how to exercise them.

2. Personal information we collect

You control the amount and type of information you give us when using the site. We may collect the following data.

Information you provide to us

Contact data: first and last name, email address, phone number, country, city, address, job title and company.
Communications data: messages you send us through forms, email, online chat, social media or phone. We ask you to limit what you share to what is necessary to answer your inquiry.
Commercial and transactional data: services contracted, orders, invoicing and payment data necessary to complete a transaction. Card data is processed directly by our payment processors.
Marketing data: your preferences for receiving communications and your interaction with them.
Information contained in the documents you provide to us in order to deliver the service (financial statements, balance sheets, notes, XBRL files and others). It may include data on individuals such as legal representatives, shareholders, auditors or employees.

We do not ask for sensitive data (health, racial or ethnic origin, religious beliefs, political opinions, biometrics, among others). We ask you not to include it in forms or documents, unless it is essential for the service and you have given your express authorization.

Information from other sources

We may combine your data with information from public sources (official registers, superintendencies, websites and professional networks), from our business and technology partners, from service providers, from our clients and, in corporate transactions, from the counterparty to the transaction.

Information collected automatically

When you use the site, we receive data from your browser or device:

Device data: IP address, browser type, operating system, device type, language and approximate location (city or country).
Activity data: the site you came from, pages visited, time spent, navigation paths and links you click.
Email interaction: whether or not you open our messages and the links you use, through web beacons or pixels.

We use this information to analyze trends among users and improve the site.

3. How we use your information

We use your personal data for the following purposes, or for those we inform you of at the time of collection:

Providing and operating the Service: handling your requests, quoting, contracting, delivering financial statement and process automation services, invoicing and providing support.
Security: protecting the site, accounts and systems, and preventing fraud, cyberattacks and unauthorized use.
Communications: sending you service notices, updates, security alerts and administrative messages.
Personalization and improvement: understanding your needs, remembering your preferences, analyzing site usage and developing new products and services.
Marketing: sending you commercial information, newsletters, event invitations and offers from us or our partners, which we may tailor to your interests. You can stop receiving them at any time (section 8).
Interest-based advertising: showing you ads related to your browsing, through the cookies described in section 4 and only when you have accepted them.
Compliance and protection: complying with the law and requests from authorities, resolving disputes, enforcing our terms and defending our rights.
Aggregated or anonymized data: creating information that does not identify you and using it to analyze and improve our business. We do not attempt to re-identify that data.

If we need to use your data for a purpose different from and incompatible with the original one, we will ask for your authorization first.

4. Cookies, tracking technologies and analytics

Our site uses cookies: small text files stored on your computer or mobile device that uniquely identify you. By accepting their use, you authorize us, and the third parties we work with, to place and read the cookies described below. You can set your browser to reject them, although some site features may stop working.

Cookie type	What we use it for	Does it require your consent?
Strictly necessary	Displaying content, validating the session and responding to your requests	No
Performance and analytics	Measuring pages visited, traffic sources and site usage	Yes
Functionality	Remembering language, country and other preferences	Yes
Advertising and targeting	Building an interest profile and showing relevant ads on other sites	Yes
Session	Linking your actions during a visit; they expire when you close the browser	No
Persistent	Remembering your preferences between visits	Yes

Web beacons. We use pixels in our emails to know, statistically, how many people open them and how they interact with them.

Google Analytics. We use Google Analytics to analyze site traffic. It collects, among other things, your IP address and browsing data, and does not identify you by name. You can prevent its use with the Google Analytics opt-out browser add-on and learn more in Google's privacy policy.

Do Not Track. Some browsers allow you to send a "Do Not Track" signal. Our site does not currently respond to that signal. You can disable tracking in your browser settings.

5. How we share your information

We do not sell or rent your personal data to third parties for marketing purposes. We may share it with the following categories of recipients, only to the extent necessary:

Strategic and technology partners. We currently have alliances with Fujitsu and Workiva. We share data with them when necessary to provide a joint service, or when you authorize it. Each partner processes the data in accordance with its own privacy policy and the agreements it has with us.
Service providers. Third parties that help us operate: cloud hosting, information technology, support, chat, email, marketing, web analytics, document delivery, contact centers and payment processing.
Payment processors. Your card data is collected and processed directly by the processor, under its own policy.
Professional advisors. Lawyers, accountants, auditors, banks and insurers, in the context of the services they provide to us.
Advertising networks and platforms. When you accept advertising cookies, companies such as Google or Meta may receive browsing data in order to show you ads.
Third parties designated by you. When you instruct us to or give us your authorization.
Authorities. Government, judicial or oversight bodies, when required by law or a valid order, to investigate violations, enforce our terms or protect the rights, property or safety of BPENNOVA, its users, employees and partners.
Assignees in corporate transactions. If BPENNOVA merges, is sold or transfers assets in whole or in part, or enters insolvency proceedings, your data could be transferred to the new controller, which must respect this policy and notify you of any changes.

We may also share aggregated or anonymized information that does not identify you.

6. International transfers and transmissions

BPENNOVA operates in Chile, Mexico and Colombia, and works with providers and partners that may be located in those or other countries, including the United States, Japan and European Union countries. As a result, your data may be stored, processed or transferred between countries other than your own.

When we send data outside your country, we take reasonable measures to ensure it receives an adequate level of protection, for example:

contracts with data protection clauses with the recipient;
verification that the country or recipient offers an adequate level of protection, where required by law;
your prior, express and informed authorization, in cases where the law requires it.

By using our site and accepting this policy, you authorize these transfers under the terms described here, without prejudice to the safeguards granted to you by the law of your country. If you are a user in the European Union or the United Kingdom, we apply the GDPR safeguards (standard contractual clauses or, in limited cases, your explicit consent). You can request more information by writing to soporte@bp-ennova.com.

7. Data retention and security

Retention

We keep your data only for as long as necessary to fulfill the purposes for which it was collected and to meet legal, contractual, accounting, tax and reporting obligations, or to establish or defend claims. To set that period, we consider the amount, nature and sensitivity of the data, the risk of unauthorized use or disclosure, and applicable regulations. When the data is no longer needed, we delete it, anonymize it or isolate it from any further processing. We may keep it in electronic format, on paper or both.

Security

We have built the site with industry-standard technical, administrative and physical measures to protect your data, including encryption of communications. We require equivalent measures from our providers. Even so, no system connected to the internet is completely secure, and we cannot guarantee the total absence of loss, unauthorized access or misuse of information.

We recommend that you protect your passwords, do not share them and log out when you finish, especially on shared or public computers. If we detect a security incident affecting your data, we will notify you and the authorities when required by law.

8. Your rights and how to exercise them

Depending on your country of residence, you may exercise the following rights over your personal data. They are not absolute, and we may deny them in the cases permitted by law.

Access: to know what data we process and receive a copy.
Rectification or update: to correct inaccurate or incomplete data.
Erasure or cancellation: to ask us to delete your data when it is no longer necessary or has been processed without a legal basis.
Objection or restriction: to object to processing, for example for direct marketing, or to ask us to restrict it.
Withdrawal of authorization: to withdraw your consent at any time. This does not affect prior processing or processing the law requires us to maintain.
Portability, where your law recognizes it.
Complaint to the authority: to file a complaint with the data protection authority of your country.

By country

Colombia. Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and supplementary regulations apply. We respond to inquiries within a maximum of 10 business days and to complaints within a maximum of 15 business days, extendable as provided by law. The authority is the Superintendency of Industry and Commerce (SIC).
Chile. Law 19,628 and Law 21,719 apply, the latter modernizing the personal data protection regime and creating the Personal Data Protection Agency, to the extent and from the date it is in force. You may exercise the rights of access, rectification, erasure, objection, portability and temporary blocking.
Mexico. The Federal Law on the Protection of Personal Data Held by Private Parties and its regulations apply. You may exercise the rights of access, rectification, cancellation and objection (ARCO). The competent authority is the Ministry of Anti-Corruption and Good Governance.
European Union and United Kingdom. If you are located there, you may also request restriction of processing, object to processing based on legitimate interest and file a complaint with the supervisory authority of your place of residence.

How to submit your request

Write to soporte@bp-ennova.com with your full name, country, a contact method, a copy of an identity document and a clear description of your request. If you act through a representative, attach the corresponding power of attorney or authorization. We may ask you for additional information to verify your identity and may decline requests without it.

Commercial communications. You can stop receiving marketing emails using the unsubscribe link at the end of each message or by writing to us. We will continue to send you service messages and other non-commercial communications.

9. Minors, links, changes and contact

Minors. The Service is intended for businesses and not for persons under 18. We do not knowingly collect data from persons under 18. If you are a parent or guardian and believe a minor has provided us with data, write to us and we will delete it within a reasonable time; we may first ask for proof of identity to prevent malicious deletions.

Links to other sites. Our site may link to third-party sites that we do not control and that have their own policies. We are not responsible for them; we recommend that you read their privacy notices.

Changes to this policy. We may change this policy at any time. We will publish the updated version on the site with its new effective date and, if we significantly change how we use your data, we will inform you by email. Continuing to use the Service after a change means you accept it.

Contact. For questions about this policy or to exercise your rights:

Website: www.bp-ennova.com

Email: soporte@bp-ennova.com