Personal Data Processing Policy

The processing of personal data of subjects domiciled in Colombia is governed by Statutory Law 1581 of 2012 and Decree 1377 of 2013, today compiled into Single Decree 1074 of 2015 (Articles 2.2.2.25.1.1 and following).

The supervisory authority is the Superintendence of Industry and Commerce (SIC), which the law charges with overseeing the processing of personal data (Articles 19 and 21) and with which you may file complaints [✉ [email protected]]. The law asks you to exhaust the query or the claim before us first: that is the admissibility requirement of Article 16.

A query is answered within a maximum term of ten (10) business days (Law 1581 of 2012, Article 14). A claim is answered within a maximum term of fifteen (15) business days counted from the day following its receipt (Article 15).

We count both terms from the business day following your request. For the claim that is what Article 15 says; for the query, whose Article 14 counts "from the date of its receipt", it is the reading we have always applied, and it is one day more for us, so we say it instead of leaving it implied.

The law allows both terms to be extended by telling you the reasons for the delay and the new date: up to five (5) further business days for the query and up to eight (8) for the claim (Articles 14 and 15). If we ever have to use that extension, we write it to you before the first term expires.

If we detect a security incident that puts your personal data at risk, we inform the Superintendence of Industry and Commerce: that is the duty of Article 17 (n) of Law 1581 of 2012, which orders the authority to be informed of breaches of the security codes and of risks in the administration of the subjects' information.

That duty carries no term in the law. The only one the Superintendence has set are the fifteen (15) business days that External Circular 002 of 2015 gives for reporting an incident in the National Registry of Databases, counted from its detection and from its being made known to the area in charge of handling it, and which binds those who must register in it. We apply that same term by our own decision, whatever the channel through which it must be filed.

The United States and the Netherlands appear, by name, on the Superintendence of Industry and Commerce's list of countries with an adequate level of protection: item 3.2 of Chapter Three of Title V of the Single Circular, which External Circular 005 of 2017 added and External Circular 008 of 2017 replaced with the version in force. Israel is not named on that list: it enters through the clause that closes that same item, which recognizes as adequate "the countries that have been declared to have an adequate level of protection by the European Commission", among which Israel stands by Decision 2011/61/EU. Towards Israel the transfer further counts, as reinforcement, on the Standard Contractual Clauses that the provider's data processing agreement incorporates and on your express and informed consent.

In addition, since the processors the policy names act on our behalf and not as controllers, the sending towards them is a transmission of data backed by the data processing agreement each one incorporates into its terms, which is the contract of Article 25 of Decree 1377 of 2013 (Decree 1074 of 2015, Article 2.2.2.25.5.2); that is why Article 24 (2) of the same decree does not require that transmission to be reported to you or a separate consent to be asked of you. The sending of data to Google is different: it is not a transmission to a processor but a transfer between independent controllers, which Section 15 of the trunk covers. For Colombia that transfer rests on the United States being named on the adequacy list cited above, on the controller-to-controller standard contractual clauses that Google's terms incorporate, and on your express and informed consent.

When the relationship with a firm ends we warn its owner at sixty (60) days and suppress its data at ninety (90); the thirty days in between are the margin to come back. Those two windows are platform policy: Law 1581 of 2012 sets no retention periods for a controller such as us, only the purpose principle (Article 4 (b)), which Decree 1377 of 2013 turns into a temporal limit in its Article 11 (Decree 1074 of 2015, Article 2.2.2.25.2.8): data is kept only for the time that is reasonable and necessary for the purposes that justified collecting it, and once those purposes are fulfilled it is suppressed, unless a legal or contractual obligation requires keeping it.

After the suppression we keep the records the law requires us to keep:

• The consent log, because Article 17 (b) obliges us to request and keep a copy of the authorization you granted, and Decree 1377 of 2013 requires us to be able to prove it in its Article 8 (Decree 1074 of 2015, Article 2.2.2.25.2.5).
• The audit trail, because Article 17 (d) obliges us to keep the information under security conditions that prevent its adulteration, loss, consultation, unauthorized use or access, and that trail is the proof that those conditions existed.
• Subject rights requests and their resolution, which are the proof of having met the terms of Articles 14 and 15, and on which the complaint you may later file with the Superintendence depends.
• The billing trail, because the Commercial Code obliges the merchant to keep its books and papers for at least ten (10) years (Article 60), and the Tax Statute obliges it to keep the information and evidence of its returns (Article 632) until the income tax return supported by them becomes final, under the term set for it by Article 46 of Law 962 of 2005.

The processing of personal data of subjects domiciled in Ecuador is governed by the Organic Law on Personal Data Protection (LOPDP) and its General Regulation (RGLOPDP), issued by Executive Decree 904.

The supervisory authority is the Personal Data Protection Superintendency (SPDP), which Article 76 of the LOPDP defines as the body that controls and oversees this matter, and with which you may file complaints.

Who the personal data protection delegate is. It is the controller, Custodio Legal, which Section 1 of the trunk identifies by its NIT and its domicile, and you write to it at [email protected]. There is no person other than the controller for you to address, and that is why we say it this way instead of pointing you to a name this policy does not publish.

Article 48 of the LOPDP lists the cases in which a delegate shall be designated: processing carried out by those who make up the public sector of Article 225 of the Constitution; activities that require "un control permanente y sistematizado por su volumen, naturaleza, alcance o finalidades del tratamiento"; large-scale processing of special categories of data; and processing that does not concern national security and State defence data that is classified or secret. Article 49 sets the delegate's functions: advising the controller and its staff, overseeing compliance with the law and with whatever the Superintendency issues, advising on risk analysis and impact assessment, and cooperating with the Superintendency as its point of contact.

The Superintendency's Regulation on the personal data protection delegate (Resolution SPDP-SPD-2025-0028-R) adds cases, and the one that looks most like us requires a delegate from private-law legal persons that provide information technology services, including those devoted to developing or deploying artificial intelligence (Article 10, item 13). Custodio Legal has not been incorporated as a company -Section 1 of the trunk identifies it by its NIT and its domicile, not by a corporate name or a commercial registry entry- so by its letter that item does not impose the designation on it. We made it anyway, and that is why the delegate is stated here.

What state the registration of the designation is in: it has not been filed. Article 5 of that same regulation requires the appointment to be registered with the Superintendency within a term of fifteen (15) days after the designation, and expressly allows it to be accepted later -late registration counts as a failure to comply with a legal security measure, not as the absence of a delegate-. Ours has not been filed. We do not say "in process" or "coming soon": there is no registration number to cite to you, and no notice or public document of ours states that the delegate is registered. The day the registration exists, this annex publishes it with its date and moves up a version. What does not depend on it is who you write to: the email address above answers you today.

In Ecuador we answer within the fifteen (15) days following receipt of the request, which is the term the LOPDP gives each of the four rights: access (Article 13), rectification and updating (Article 14), erasure (Article 15) and objection (Article 16). The law calls them a plazo and does not qualify them as business days, so we count calendar days, which is the reading that favors you most.

Beyond those four, Article 17 of the LOPDP recognizes the right to portability: you may download from 'My account > Your privacy' a structured, machine-readable copy of your account data. That article sets no term of its own; we answer portability within the same fifteen days.

If we detect a security incident that puts your personal data at risk, we notify the Personal Data Protection Superintendency and the Telecommunications Regulation and Control Agency as soon as possible and, at the latest, within the término of five (5) days from when we become aware of it (Article 43 of the LOPDP). We notify you without delay when the incident carries a risk to your fundamental rights, within the término of three (3) days counted from when we learn of that risk (Article 46 of the LOPDP).

The providers listed in Section 10 of the trunk act as processors, not as controllers. Article 23 of the Superintendency's General Rule on transfers (Resolution SPDP-SPD-2026-0004-R, of January 28, 2026) states that, under Ecuadorian law, a processing mandate is neither a transfer nor a communication of personal data; what backs those sendings, then, is the data processing agreement each processor incorporates into its terms, with confidentiality and security obligations.

The sending to Google is different, because Google is not a processor but an independent controller, as Section 15 of the trunk explains: that one is an international transfer. The Personal Data Protection Superintendency has not declared, as far as we have been able to verify by walking its list of resolutions on September 9, 2026, any country with an adequate level of protection; Articles 11 to 19 of that same general rule set the procedure for declaring one, and it has not been used yet. That transfer relies on your explicit and informed consent (Article 60, item 2, of the LOPDP), which you give by accepting this policy knowing the destination and the safeguard, and on the independent-controller terms Section 15 cites by version.

One precision about contractual clauses, so that you do not read more into them: the Standard Contractual Clauses of European Commission Implementing Decision (EU) 2021/914 that the text generation provider's agreement incorporates govern the transfers that provider makes outside the European Economic Area, and they are not the standard clauses Ecuador recognizes. Articles 20 and 22 of the Superintendency's general rule recognize as an adequate guarantee the model contractual clauses of the Ibero-American Data Protection Network, and we do not claim to have those signed.

The artificial intelligence features that Section 14 of the trunk describes are an artificial intelligence system within the meaning of Resolution No. SPDP-SPD-2026-0009-R of the Personal Data Protection Superintendency, «General rule for guaranteeing the right to personal data protection in the use of artificial intelligence systems», signed in Quito on February 12, 2026. That rule applies regardless of where the system and the provider are located (Article 1), so it governs this processing even though the inference runs outside Ecuador.

Before it, Custodio Legal acts as a deployer —the one who, by using an artificial intelligence system, carries out the provision of a service (Article 2, item 2)— and as an implementer —the one who implements it in its internal processes (Article 2, item 4)—. It neither develops nor trains models, and so it is not a developer within the meaning of that rule.

None of those features takes decisions with legal effects on you, or that similarly affect you, without human intervention. Article 20 of the LOPDP grants you the right not to be subject to a decision based solely or partly on automated assessments that produces such effects, and Article 4 of the resolution requires that right to be guaranteed at all times: artificial intelligence results are supporting material that a professional verifies before using, and Section 14 of the trunk describes feature by feature what each one does, what data leaves and what runs on your click.

You may object to the artificial intelligence processing that runs without a click of yours —indexing for questions with citations, fact extraction and matter reassessment, which item (viii) of Section 14 lists— by writing to [email protected], and through whatever means the platform makes available to you for that. The features that produce a result to read run only when you execute them, so not using them amounts to not authorizing them. Objections are answered within the fifteen (15) days this annex declares above.

The inference runs on the infrastructure of the providers Section 10 of the trunk lists: text generation at Nebius B.V. (Netherlands) and the vector representations of semantic search at Voyage AI (United States). Both act as processors, and what backs those sendings is what the «International Transfer» section of this annex says above.

We keep the record of the processing activities carried out through artificial intelligence systems —with the automated decisions that may generate legal impacts or affect rights and freedoms— and the personal data protection impact assessment of these features, which Articles 5 and 7 of the resolution require. Both are at the disposal of the Personal Data Protection Superintendency.

Data is kept for no longer than is necessary to fulfil the purpose of its processing (Article 10, letter i, of the LOPDP). When the relationship with a firm ends we warn its owner at sixty (60) days and suppress its data at ninety (90); the thirty days in between are the margin to come back. Those two windows are platform policy: the LOPDP sets the retention principle, not the periods.

After the suppression we keep four records, for three reasons, and we say which is which. The consent log and the audit trail, because Article 10, letter k, of the LOPDP requires us to demonstrate to you and to the Superintendency that the processing complied with the law, and that evidence is the only thing that demonstrates it. Subject rights requests and their resolution, for the same reason and with respect to the fifteen days above. And the billing trail, because of the provider's accounting and tax obligations, which are not Ecuadorian: Custodio Legal is domiciled in Colombia, as Section 1 of the trunk declares, and it is the Colombian accounting and tax rules that set how long he must keep his own books and receipts.

The processing of personal data of subjects domiciled in the Dominican Republic is governed by Ley núm. 172-13, on the comprehensive protection of personal data held in files, public registries, databanks and other technical means of data processing, of December 13, 2013 (Gaceta Oficial núm. 10737 of December 15, 2013). Its rules are of public order and apply throughout the national territory (article 3), to personal data recorded in any databank capable of processing, in the public and in the private sphere (article 2).

Your authorization. Article 5, paragraph 4, requires that the processing and the assignment of your data have your free, express and conscious consent, which must be given in writing or by an equivalent medium and which -when given together with other declarations- must appear expressly and prominently. That consent follows the duty to inform of paragraph 3 of the same article: the purpose and the recipients, the existence of the file and the identity and address of whoever answers for it, and the possibility of exercising the rights of access, rectification and deletion. That is what the consent screen shows you before you accept, and what is frozen, with its date, in the consent log.

The authority. Ley núm. 172-13 did not create a general-purpose data protection authority. Its supervisory body, the Superintendencia de Bancos de la República Dominicana, supervises "los archivos, registros o bancos de datos, públicos o privados, destinados a proveer informes crediticios" (article 29), and the entities that must register with it are the Sociedades de Información Crediticia (article 43). Custodio Legal is not a credit information company and does not provide credit reports, so there is today no regulator in the country with which we register databases, request transfer authorization or answer for this processing. What the law does require of us, and we comply with, is having information policies that guarantee the security and control measures of article 42, and the duties of article 13: keeping information securely, updating, rectifying or deleting it in good time, handling your queries and complaints, and maintaining an internal manual of policies and procedures.

You may write to [email protected] to exercise your rights. If you are not satisfied, the law opens the judicial hábeas data action to you (articles 7, 17 and 21), which follows the amparo procedure and is heard by the judge of the defendant's domicile (article 20).

As of September 9, 2026 Ley núm. 172-13 is still the only Dominican personal data protection statute, and no later law amended or repealed it: we verified that against the complete repertoire of the Consultoría Jurídica del Poder Ejecutivo. If a reform ever creates a supervisory authority, we will update this annex and tell you before the change reaches you.

Ley núm. 172-13 does set deadlines, and they are the ones we apply:

• Access: five (5) business days from your request. Article 10 imposes it on the user of the databank, and article 12, after setting that same term for the credit report, says expressly that "igual disposición aplica para las demás entidades que manejan bancos de datos, públicos o privados". We are one of them.
• Rectification, updating and cancellation: ten (10) business days from our receiving your complaint or noticing the error, under article 8, and at no cost to you. If we had already communicated the datum to a third party, we notify it of the rectification or the deletion within the following five (5) business days.
• Objection: Ley núm. 172-13 sets no term of its own for it. Said the other way round from how it sounds: article 9 recognises objection as a right independent of the other three -"no puede entenderse que el ejercicio de ninguno de ellos sea requisito previo para el ejercicio de otro"- but it does not say within how many days it must be answered, and no other article of the law says so either. We answer it within the same ten (10) business days of article 8. That term is ours, not the law's, and that is why we write it here instead of citing an article to you that does not exist.

If the deadline passes without our answering, article 8 entitles you to bring the hábeas data action with no further requirement.

Two limits the law itself sets, and that we would rather you read here than meet unannounced: while we verify a datum you challenged, when reporting on it we record that it is under review (articles 8 and 21); and deletion does not proceed where it could harm the rights or legitimate interests of third parties, or where a contractual or legal obligation to keep the data exists (articles 8 and 15).

Beyond those four rights, you may download from 'My account > Your privacy' a structured, machine-readable copy of your account data. Ley núm. 172-13 recognizes no right of portability: we give you that copy by our own decision.

Ley núm. 172-13 imposes the duty of security -adopting the technical, organizational and security measures that prevent alteration, loss, processing, consultation or unauthorized access: article 5, paragraph 5, and article 13, paragraph 2- but it sets no incident notification deadline and no authority to file one with for a controller such as us. By our own decision, and not because a Dominican rule imposes it, if we detect an incident that puts your personal data at risk we tell you without undue delay and, in any event, within the three (3) days following confirmation, with what we know and what we are doing.

Operating the Service means transmitting your data outside Dominican territory, which is what article 6, paragraph 20, of Ley núm. 172-13 calls an international transfer of data. The Dominican Republic publishes no list of countries with an adequate level of protection, and the law requires no prior authorization from any authority: article 80 lists the cases in which the transfer proceeds, and ours relies on two of them.

The first is your own authorization: paragraph 1 admits the transfer where the natural person, "libre y conscientemente", decides to authorize it of their own will, and that is what you do by accepting this policy knowing the destination and the safeguard. The second is paragraph 6: the transfer necessary for the performance of the contract between the data subject and the controller, without which there is no Service to render.

To that are added the contractual guarantees each provider incorporates into its terms: confidentiality and security obligations and -for the text generation provider- the Standard Contractual Clauses of European Commission Implementing Decision (EU) 2021/914 that agreement incorporates for transfers outside the European Economic Area. They are not a Dominican requirement: they are the safeguard we do have, and that you can verify.

The same holds for the sending of data to Google, which is not a processor of ours but an independent controller, as Section 15 of the trunk explains: Ley núm. 172-13 does not make the basis of a transfer depend on the figure of whoever receives the data, so that sending rests on the same two items of Article 80, and further on the controller-to-controller standard contractual clauses that Google's terms incorporate.

When the relationship with a firm ends we warn its owner at sixty (60) days and suppress its data at ninety (90); the thirty days in between are the margin to come back. Those two windows are platform policy: Ley núm. 172-13 sets no retention periods for a controller such as us.

What outlives the suppression, and why:

• The evidence of your authorization and of the processing -the consent log and the audit trail- because article 5, paragraph 4, requires consent to be given in writing or by an equivalent medium, and article 15 orders that what is cancelled be blocked and kept at the disposal of the branches of the State, for the liabilities arising from the processing, throughout their limitation period.
• Subject rights requests and their resolution, which are the evidence of having met the deadlines of articles 8 and 12.
• The billing trail, because the Tax Code (Ley núm. 11-92), in its article 50, subparagraph h) -as amended by article 105 of Ley núm. 155-17- requires keeping in orderly form, for a period of ten (10) years, the accounting books, the receipts or proofs of payment and any document, physical or electronic, relating to the taxpayer's operations and activities. That duty is your firm's as a Dominican taxpayer; we keep the proof so that it can meet it.

Over all of them runs the same limit of article 8: deletion does not proceed where a contractual or legal obligation to keep the data exists.

The processing of personal data of data subjects domiciled in Costa Rica is governed by Ley N° 8968, on the protection of the person with regard to the processing of their personal data, published in La Gaceta N° 170 of September 5, 2011, and by its Reglamento, Decreto Ejecutivo N° 37554-JP of October 30, 2012, amended by decretos ejecutivos N° 40008-JP of 2016 and N° 41582 of 2019. Both pieces are named together because the deadlines that reach you -the five business day term, the breach notice- live in the regulation, not in the law.

Your authorization. Ley N° 8968 makes consent the door to processing: its article 30, subparagraph a), makes it a serious offence to "recolectar, almacenar, transmitir o de cualquier otra forma emplear datos personales sin el consentimiento informado y expreso del titular de los datos". That is what the consent screen asks you for before you accept, and what is frozen, with its date, in the consent log. You can revoke it whenever you want, through the mechanism article 7 of the Reglamento requires us to give you: prompt, simple and free of charge.

The authority. It is the Agencia de Protección de Datos de los Habitantes (PRODHAB), a maximum deconcentration body attached to the Ministerio de Justicia y Paz which article 15 of Ley N° 8968 created. It is the authority you complain to if you are not satisfied with what we do, and you can also write to us at [email protected].

And how you complain, so that you do not have to look it up. Article 24 of Ley N° 8968 gives the complaint to anyone with a subjective right or a legitimate interest who considers that a database is acting against the rules or the principles of the law. Article 25 sets the procedure: PRODHAB gives us three business days to state whether the charges are true and to file evidence -and if we do not file that report, "se tendrán por ciertos los hechos acusados"-, it may require information from us, inspect our databases on site and order interim measures, and must issue the final decision no later than one month after the complaint; against it there is a request for reconsideration within the third day, resolved in eight days. If you are right, article 26 orders the immediate deletion, rectification, addition or clarification of the data, or bars its transfer or disclosure. Article 27 also lets it open a sanctioning procedure of its own motion. Articles 58 to 72 of the Reglamento develop that procedure with the same terms.

On the registration of databases, and why we did not do it. Article 21 of Ley N° 8968 orders the registration before PRODHAB of "toda base de datos, pública o privada, administrada con fines de distribución, difusión o comercialización". Custodio Legal does not distribute, disseminate or commercialise third party data: it processes it on behalf of a firm, which is the party that decides about it. Under that reading there is no database to register, and the annual two hundred dollar levy of article 33 does not run either, because that article imposes it on "las personas responsables de bases de datos que deban inscribirse ante la Prodhab, de conformidad con el artículo 21". This is our reading of the text, not a confirmation from PRODHAB nor the opinion of a Costa Rican lawyer. If the legal review of this annex concludes otherwise, we will register the database, pay the levy and say so here.

As of September 10, 2026 Ley N° 8968 is still in force with no amendment whatsoever: PRODHAB itself states so on its regulations page, updated on September 9, 2026. What we could not verify is whether a reform bill is before the Asamblea Legislativa -its site did not respond on the day this legislation was read- so we assert neither that there is one nor that there is not. If a reform changes what this annex promises, we will update it and tell you before the change reaches you.

In Costa Rica the Service will offer a one-off lookup of a case file by its number to someone with no account, which Section 2 of this policy's trunk describes. What follows is what Costa Rican law says about it, with its articles and with its reservation.

On what ground. On article 5, point 2, item b) of Ley N° 8968, which dispenses with express consent when «se trate de datos personales de acceso irrestricto, obtenidos de fuentes de acceso público general», and on article 3, item c), which defines that data as «los contenidos en bases de datos públicas de acceso general, según dispongan leyes especiales y de conformidad con la finalidad para la cual estos datos fueron recabados».

And with a written reservation, because that item sets two conditions and we treat only one as met. The purpose one, yes: we look up so that it can be looked up, which is the reason the Poder Judicial publishes the state of a case file. The «ley especial» one we have not verified: we did not find in SINALEVI a Costa Rican statute declaring the lookup of court records to be of general public access, and we do not claim one. What is true and does not depend on it is that we do not process the parties' identity: they come back masked, and article 9, point 3, takes out of the unrestricted category data «cuyo tratamiento pueda afectar los derechos y los intereses de la persona titular». Masking is what makes that classification decide nothing.

The rest of the law keeps running. The article 5 exception is an exception to consent, not to the rest: article 6 requires the datum to be adequate to the purpose for which it was collected and to be deleted when it stops being relevant, and that is what the masking and the ephemeral row do. The IP address of whoever looks up is processed only to limit how many lookups come from one place, and the row is deleted after two (2) hours.

And about registration with PRODHAB. This annex's applicable-law section already explains why, on our reading, there is no database to register, and this lookup does not change that reading: article 21 requires registering a database «administrada con fines de distribución, difusión o comercialización», and article 2, item j), of the Reglamento defines those words as requiring «un fin de comercializar el dato o medie el lucro con la base de datos». A free lookup that neither sells the datum nor profits from the database stays, on that reading, outside article 21. It is our reading and not PRODHAB's —we read no resolution of theirs on this point— and if legal review concludes otherwise we register the database, pay the fee of article 78 of the Reglamento, and say so here.

The articles in this section were read verbatim on SINALEVI on September 19, 2026 —Ley N° 8968, ficha 70975, version 85989; Reglamento, Decreto Ejecutivo N° 37554-JP, ficha 74352, version 115361— with HTTP 200.

Ley N° 8968 sets a single deadline, for everything: its article 7 requires answering "de manera gratuita, y resolver en el sentido que corresponda en el plazo de cinco días hábiles". Article 18 of the Reglamento is the one that says from when it is counted: "cinco días hábiles, contados a partir del día siguiente en que la misma haya sido recibida". That is the one we apply, because it is the one that yields a concrete day.

• Access: five (5) business days from the day after your request (Law, article 7.1; Reglamento, articles 18 and 21).
• Rectification: five (5) business days, on the same terms (Law, article 7.2; Reglamento, articles 18, 23 and 24).
• Erasure or deletion: five (5) business days (Law, article 7; Reglamento, articles 18, 25 and 26).
• Revocation of consent: five (5) business days to execute it, and within that same term we notify anyone we had transferred your data to, who have another five to execute it on their side (Reglamento, article 8).
• Confirmation that the processing ceased: three (3) business days, free of charge, if you ask us for it (Reglamento, article 9). It is the shortest term in this section.

Objection and portability do not exist in Costa Rican law, and this annex does not promise them to you: neither Ley N° 8968 nor its Reglamento names them. What you can do, and what stands in for the first, is revoke your consent. And from 'My account > Your privacy' you can download a structured, machine-readable copy of your account data: we give you that copy by our own decision, not because a Costa Rican rule requires it.

Two counting rules the rule itself imposes, and we would rather you read them here than when they reach you. The first: if your request arrives incomplete or unclear, we may ask you once only, within the first five business days, for the missing details; you have five business days to answer, and if you answer a fresh five day term starts on the following day. If you do not answer, the request is treated as not filed (Reglamento, article 19). The second: between two access requests of yours there must be a minimum interval of six months, unless you set out to us, with reasons, why you believe your rights are being infringed (Reglamento, article 21).

One more limit, and it is the one that supports the retention section of this annex: article 26 of the Reglamento excludes from erasure the data "que deban ser mantenidos por disposición constitucional, legal o resolución de órgano judicial". Data a law requires us to keep is not deleted on request; what we do is tell you which law that is.

If the Costa Rican business day calendar for the year is not loaded in the platform, your request is filed all the same and we attend to it: what we do is mark the due date as estimated rather than certain, instead of giving you a date we cannot compute.

Costa Rica does set a breach notice deadline, and it is not in the law but in article 38 of its Reglamento: the controller must inform the data subject "sobre cualquier irregularidad en el tratamiento o almacenamiento de sus datos, tales como pérdida, destrucción, extravío, entre otras, como consecuencia de una vulnerabilidad de la seguridad", and has five business days from the moment the vulnerability occurred to do so. Within that same term the exhaustive review opens, to measure the impact and decide the corrective measures.

Two things about that deadline, said plainly. The first: it runs from when the incident occurred, not from when we detected it, which is stricter than the "without undue delay from knowledge" the trunk's incident protocol is written to. In Costa Rica we apply the Costa Rican deadline. The second: the recipient is twofold -you and PRODHAB- and both are told the same thing, which is what article 39 of the Reglamento enumerates: the nature of the incident, the personal data compromised, the corrective actions taken immediately, and the means or the place where you can obtain further information.

Operating the Service means transmitting your data outside Costa Rican territory. Costa Rica solves that with a single door, and it is article 14 of Ley N° 8968: controllers of databases "solo podrán transferir datos contenidos en ellas cuando el titular del derecho haya autorizado expresa y válidamente tal transferencia", and provided the transfer does not infringe the principles and rights that same law recognises.

There are no other bases. Costa Rica publishes no list of countries with an adequate level of protection, and its law does not recognise standard contractual clauses as the basis of the transfer. What supports it is your express authorization, and that is why we ask you for it where it can genuinely be given: on the consent screen, naming the destination and the safeguard, before the data leaves.

The data of the firm's clients and opposing parties is a different matter, and it is worth being clear about whose duty it is. Over that data the controller is the firm, not Custodio Legal: it is the firm that has the relationship with the data subject and that obtains their express authorization to process and to transfer it, and that is what the firm declares when it accepts the third party data declaration, which cites Ley N° 8968 as its basis. We are its processor and act on its instructions.

To that are added the contractual guarantees each provider incorporates into its terms: confidentiality and security obligations and -for the text generation provider- the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 which that agreement incorporates for transfers outside the European Economic Area. They are not the basis of the Costa Rican transfer -that is your authorization, and it alone- they are the additional safeguard we do have and that you can verify.

The same holds for the data sent to Google, which is not a processor of ours but an independent controller, as Section 15 of the trunk explains: Ley N° 8968 does not distinguish the basis of the transfer by the role of whoever receives the data, so that sending rests on the same express authorization of article 14, and additionally on the controller-to-controller standard contractual clauses that Google's terms incorporate.

Why we take this so seriously: transferring data against the rules of chapter III of the law is a serious offence under article 30, subparagraph b), with a fine of five to twenty base salaries (article 28, subparagraph b). The consequence of getting this wrong is not an observation: it is a penalty.

When you open your firm —and afterwards, from Settings— you may enter your membership number of the Colegio de Abogados y Abogadas de Costa Rica. It is optional: if you do not enter it, we check nothing, and your firm works the same. If you do, we ask the public member search the bar publishes at abogados.or.cr, and what we do with the answer is show a badge on your firm's profile.

What leaves here for the bar is the number and nothing else: your name does not travel, nor your firm's, nor any of your clients'. What comes back is a page with the result, and from that page we keep exactly three things: whether the bar knows the number, the condition it records —in good standing or suspended— and the date we asked. Nothing more. The bar's search prints, next to each member, their full name, national id number, address, email and phone: none of that is stored, and the program that reads the answer discards it before it reaches the database. This is the information-quality principle of article 6 of Ley N° 8968: only the datum the purpose needs is kept, and the purpose here is showing a badge.

Asking once is the rule, and only when the number changes. If the bar does not answer, the badge says it could not be checked and that is where it stops: we do not insist.

You can withdraw the number whenever you want, by leaving the field blank in Settings. Doing so deletes the whole row —the number, the condition and the date— and the badge disappears.

The badge decides nothing. A number the bar does not know, one with a suspension recorded, and a bar that does not answer all give exactly the same access to the Service: what changes is what the profile says. We do not close the door on you because of what a third party's page says — or fails to say.

When the relationship with a firm ends we warn its owner at sixty (60) days and suppress its data at ninety (90); the thirty days in between are the margin to come back. Those two windows are platform policy: Ley N° 8968 sets no retention periods for a controller such as us. What its Reglamento sets, in article 11, is a ceiling: the retention of personal data that may affect its subject "no deberá exceder el plazo de diez años, desde la fecha de terminación del objeto de tratamiento del dato, salvo disposición normativa especial que establezca otro plazo". None of the windows in this annex exceeds it.

What outlives the suppression, and why:

• The evidence of your authorization and of the processing -the consent log and the audit trail- because processing without informed and express consent is a serious offence (Ley N° 8968, article 30, subparagraph a) and proving that we had it requires keeping the record. Article 26, subparagraph b), of the Reglamento is what allows keeping it after suppressing the rest: data that must be kept by legal provision is not deleted.
• The data subject requests and their resolution, which are the evidence of having met the five business days of article 7 of the Law and article 18 of the Reglamento.
• The billing trail, for five years, and by two routes that reach the same number. The Código de Comercio requires the merchant to "conservar los libros de contabilidad desde que se inician hasta cinco años después del cierre del negocio y conservar igualmente la correspondencia, las facturas y los demás comprobantes, por un período no menor de cinco años, contado a partir de sus respectivas fechas, salvo que hubiera juicio pendiente en que esos documentos se hubieran ofrecido como prueba" (article 234, subparagraph d), and repeats the five years for a business being wound up in its article 270. The Código de Normas y Procedimientos Tributarios reaches the same term through the taxpayer's duty: "los contribuyentes o los responsables deberán conservar los duplicados de estos documentos por un plazo de cinco años" (article 109). That duty is your firm's, as a Costa Rican merchant and taxpayer; we keep the receipt so it can comply.

One clarification about the number, because it is easy to confuse: the Código de Normas y Procedimientos Tributarios sets the statute of limitations of the Tax Administration's action at four years (article 51). Four years is what it has to collect; five is what has to be kept. The window this annex promises is the retention one.

The processing of personal data of data subjects domiciled in Uruguay is governed by Ley N° 18.331, on the Protection of Personal Data and the «Habeas Data» Action, of August 11, 2008, and by its amending statute, Ley N° 19.670 of October 15, 2018. They are implemented by Decreto N° 414/009 of August 31, 2009 and Decreto N° 64/020 of February 17, 2020; the four pieces are named together because the numbers that concern you — the registration, its terms, the hours of an incident — live in the decrees and not in the statute.

The principles. Article 5 of the statute lists seven and makes them the criterion for interpreting everything else: legality, truthfulness, purpose, prior informed consent, security of the data, confidentiality and accountability.

Your authorisation. Article 9 requires consent to be «free, prior, express and informed, and it must be documented»: that is what the consent screen asks you for, and what is frozen with its date in the consent log. That same article, in its letter D), is what allows your firm to upload its own clients' data to the platform without asking them again, because it derives from a professional relationship and is necessary to perform it. It does not serve the international transfer, which has its own list and its own section below.

Confidentiality, and why it weighs more here than elsewhere. Article 11 requires whoever processes data from a database to use it «confidentially and exclusively for the ordinary operations of its line of business», and subjects to professional secrecy — with an express reference to article 302 of the Criminal Code — every person taking part in any stage of the processing. That duty survives the end of the relationship. It reaches whoever operates the platform, not only your firm.

Accountability. Article 12, in the wording given by article 39 of Ley N° 19.670, names the controller and the processor in the same sentence and orders them to adopt «privacy by design, privacy by default, data protection impact assessment, among others» and to demonstrate their effective implementation. The processor is not liable less than the controller: it is liable the same.

Two things this regime has and none of our others does. The first: article 2 extends the protection to legal persons where applicable, so your firm is a data subject itself and not only a controller of its clients' data. The second: article 6 makes registration the gateway to lawfulness — «the formation of databases shall be lawful when they are duly registered» — and that is why this annex devotes a whole section to it.

Why Uruguayan law reaches us. Article 37 of Ley N° 19.670 and article 1 of Decreto N° 64/020 subject to this law a controller or processor not established in the country when the offering of services is directed at inhabitants of the Republic. The regulation assesses that direction through elements such as the language, the reference to payment in national currency or the provision of related services, and adds that under no circumstances may the contracting parties exclude the application of national law where it applies. Offering you the Service is what triggers it, and we do not treat that as arguable.

The authority. It is the Unidad Reguladora y de Control de Datos Personales (URCDP), a decentralised body of AGESIC. It is the authority you complain to if you are not satisfied with what we do, and you can also write to us at [email protected]. Complaining to the URCDP does not take away the habeas data action before the Uruguayan courts, nor the other way round.

In Uruguay the Service will offer a one-off lookup of a case file by its IUE to someone with no account, which Section 2 of this policy's trunk describes. What follows is what Uruguayan law says about it, with its articles.

On what ground. On article 9, item A) of Ley N° 18.331, which dispenses with prior consent when «los datos provengan de fuentes públicas de información, tales como registros o publicaciones en medios masivos de comunicación», read together with article 9-BIS, which lists what counts as a public source. The judiciary's portal is not named in items A) to C) of that article, and we do not hide it: what reaches it is item D), the residual one —«todo otro registro o publicación en el que prevalezca el interés general en cuanto a que los datos personales en ellos contenidos puedan ser consultados, difundidos o utilizados por parte de terceros»— and that item ends with a condition we meet before invoking it: «en caso contrario, se podrá hacer uso del registro o publicación mediante técnicas de disociación u ocultamiento de los datos personales».

That is why the parties come back masked, and it is not decoration. Masking is the technique that item prescribes, and dissociation is defined by article 4, item G): «todo tratamiento de datos personales de manera que la información obtenida no pueda vincularse a persona determinada o determinable». We do not return the parties' identity, so we do not depend on settling whether «el interés general» prevails in the publicity of a case file.

The purpose principle keeps running. Article 8 forbids using the datum for «finalidades distintas o incompatibles con aquellas que motivaron su obtención», and the URCDP applied it to data that came from a public source (Resolución N° 94/014, of 31 July 2014, collected in its «Principales criterios administrativos 2009-2015», where it also writes that it is advisable that «el tratamiento de los datos personales no esté vinculado con la identidad de su titular»). The purpose for which the judiciary publishes the state of a case file —so that it can be looked up— and this lookup's purpose are the same, which is why no history is kept and nothing is built out of what was looked up.

And about whoever looks up. Their IP address is processed only to limit how many lookups come from one place, and the row the lookup writes is deleted after two (2) hours. That is article 8 in its second paragraph: data «deberán ser eliminados cuando hayan dejado de ser necesarios o pertinentes a los fines para los cuales hubieren sido recolectados».

What this section does not claim. That the ephemeral row is not a «base de datos» for the purposes of this law. Article 4, item A), sets no permanence threshold —«cualquiera que fuere la modalidad de su formación, almacenamiento, organización o acceso»— and item M) counts the consulta among processing operations: we assume it is one, which is why it falls within what the next section says about registration with the URCDP. Nor have we read any URCDP resolution or opinion about a private third party that looks up the judicial portal and publishes the result with the parties masked; if one appears and says otherwise, this annex changes before the change reaches you.

The articles in this section were read verbatim in the text of Ley N° 18.331 that IMPO publishes, on September 19, 2026, and the compilation of criteria on the URCDP's site the same day.

This is the duty no other country of the Service imposes on us, and that is why it is written here with all its parts.

Who it reaches. Articles 28 and 29 of Ley N° 18.331 require every database to be registered, and article 2 of Decreto N° 64/020 says it of us in so many words: controllers and processors not established in the territory «must comply with the obligations set out in Ley N° 18.331 […] including the registration of their databases and providing the corresponding contact information to the Unidad Reguladora y de Control de Datos Personales». It is not a reading of ours: it is the text of the regulation.

What the registration declares. Article 16 of Decreto N° 414/009 sets its content, and article 29 of the statute lists what cannot be missing: identification of the database and of its controller, nature of the data, procedures for obtaining and processing it, security measures, exercise of rights, destination of the data and to whom it may be transmitted, retention period and how to access and rectify. And it brings a limit worth reading: «no data user may hold personal data of a nature other than that declared in the register».

The two terms and the display. Registration is filed within 90 days of the start of activities (Decreto N° 414/009, article 17), is updated quarterly (article 20) and the number and date of the resolution approving it are displayed in a visible, accessible place (article 19). The procedure is online and free of charge.

The number of our resolution is not here yet. This gap — URCDP resolution number: pending; date: pending — is deliberate and is filled the day the procedure completes, in this annex and in the site footer. While it says «pending», what you are reading is that the procedure has not been completed, not that it exists and we do not publish it.

And what we could not verify, said as such. The procedure requires a Uruguayan electronic identity — Usuario gub.uy, digital DNI, Identidad Digital Abitab or TuID Antel — and the procedure page does not document a route for a foreign company with no representative in the country. We claim neither that it can be done nor that it cannot: it is the first question of this annex's legal review, and on its answer depends whether registration is a form or a local mandate.

The lookup with no account falls in here. The ephemeral row that lookup writes is, in the terms of article 4, item A), an organized set of personal data subject to processing, and it therefore falls within the registration this section declares pending. We do not leave it out for lasting two hours: no Uruguayan rule we have read exempts a database for being ephemeral.

Ley N° 18.331 does set a deadline, and it is the same for everything: five (5) business days.

• Access: five business days «from having been requested» (article 14, paragraph 3). Once the term expires without an answer, or if it is denied without justified reason, the habeas data action becomes available.
• Rectification, updating, inclusion and erasure: five business days «from receipt of the request», or the same term to tell you why we believe it does not apply (article 15, paragraph 2). They are free of any charge to you.
• Information to a data subject whose data was not collected from them: five business days from receipt of the request (article 13, paragraph 2).
• Propagation: if we had already communicated or transferred the data, we notify the rectification, inclusion or erasure to whoever received it within the fifth business day of processing it (article 15, paragraph 6).

The count starts on the same day as your request, not the next one. The articles say «from having been requested» and «from receipt of the request», without the word «following» that the regulations of other countries where we operate do have, and in case of doubt we count the way that favours you.

Two further rules the statute itself sets. Free access is exercised «at six-month intervals», unless a legitimate interest arises anew (article 14): it is an admissibility requirement for the second request, not a term. And while we verify, rectify or include a datum, on a third party's request we record that the information is under review (article 15, paragraph 5).

Objection and portability do not exist as standalone rights in the Uruguayan regime. We searched for the words in the current text of the statute and of Decreto N° 414/009 and they do not appear. If you ask us for either, we file it and answer you; what we do not do is promise you a statutory deadline Uruguayan law does not set.

What the platform computes today, and what it does not yet. The Uruguayan business calendar is loaded — the public holidays of Decreto Ley N° 14.977, their shift to Mondays under Ley N° 16.805, Carnival and Tourism Week derived from Easter, and the two judicial recesses of article 86 of Ley N° 15.750 — so your request is born with a due date computed over Uruguayan business days and not over calendar days. Two reservations, said before they reach you: the computation rests on our reading of articles 14 and 15, which no Uruguayan lawyer has curated yet, and the holiday table does not contain the judicial officer's day — we found no statute or court ruling declaring it a holiday — nor a holiday declared by a statute within the year, which goes in when it is published.

This section is more explicit than its counterpart in the other countries of the Service, and not by taste: Uruguayan law requires it in so many words.

What the law orders us to tell you. Article 13 of Ley N° 18.331, in the wording given by article 62 of Ley N° 20.075 of October 20, 2022, requires us to inform you beforehand, expressly, precisely and unequivocally, of «the existence or absence of international data transfers» (letter F) and, in the automated processing of article 16, of «the assessment criteria, the processes applied and the technological solution or program used» (letter G).

What the artificial intelligence feature does. Over the text of a matter and the fragments of the documents your firm uploads, the platform generates summaries, analyses, drafts and answers with a citation to the source. The technological solution is a third party's language model, to which that text is sent through a programming interface and which returns text. Who those third parties are, what each one receives and under which safeguard it travels is in the processors section of the trunk of this policy and, one by one, in the sub-processor list the Service publishes. There is an international transfer in that sending, and the next section says what it rests on.

Which criteria are applied, and which are not. The model produces text from the text it is given; it does not score, does not classify people, does not compute risk and does not profile anyone's conduct, solvency or reliability, and its output decides nothing on its own: a lawyer reads and uses it. When the platform proposes a deadline or a status, it proposes it with the rule or the fact that sustains it, and the decision remains with whoever runs the matter.

Your right to challenge. Article 16 gives you the right not to be subject to a decision with significant legal effects «based on automated processing of data intended to evaluate certain aspects of their personality», to challenge the private decision whose sole basis is that processing, and to obtain information about the assessment criteria and the program used. That article sets no deadline, so we do not promise you one: write to us at [email protected] and we answer with the criteria and the program. As the platform takes no decisions with legal effects over anybody, we expect this right to have nothing to challenge; if one day it did, this annex would say so first.

And what you can switch off. The artificial intelligence features have their own switches in the platform: a firm may leave them off and use the rest of the Service. Switched off, no text is sent to the generation provider.

Uruguay does not have one breach clock: it has three, and only two run on our side. It is worth knowing which is which, because the third is yours; and behind the three there is a fourth duty, the later report, which has no clock.

• Twenty-four (24) hours to start mitigating. Once an incident causing disclosure, destruction, loss, alteration or unauthorised access to personal data is confirmed, the controller and the processor must start the procedures needed to minimise its impact «within the first 24 hours of confirmation» (Decreto N° 64/020, article 3). That clock runs for us.
• Immediately, to tell you. When the breach becomes known to the processor — us — «it shall communicate it immediately to the controller» (Decreto N° 64/020, article 4, paragraph 3). That notice reaches you with the date and time the incident happened and not only with when we learned of it, because your own term depends on that datum.
• Seventy-two (72) hours to the URCDP, and they are yours. The controller must communicate the breach to the URCDP «within a maximum of 72 hours from becoming aware of it» (Decreto N° 64/020, article 4), with the certain or estimated date, the nature, the data affected and the possible impacts; and must communicate it in clear, plain language to the data subjects significantly affected. Over the data your firm uploads, the controller is you: that communication is yours and we give you the inputs. Article 38 of Ley N° 19.670 adds that the URCDP coordinates the course of action with CERTuy.
• The detailed report afterwards. Once the breach is resolved, the controller draws up a report of the breach and of the measures adopted and communicates it to the URCDP (Decreto N° 64/020, article 4, last paragraph). If the incident was ours, we give you that report in writing.

Over the data of your own account — your email, your billing, your consent log — the controller is us, and there the three clocks run on our side.

Operating the Service entails transmitting your data outside Uruguayan territory. Uruguay regulates that in article 23 of Ley N° 18.331, and it has to be read in full because it opens with a prohibition: the transfer «with countries or international organisations that do not provide adequate levels of protection» is prohibited.

The United States is not among the adequate ones. URCDP Resolution N° 23/021, of June 8, 2021, considers appropriate the members of the European Union and the European Economic Area, Andorra, Argentina, the private sector of Canada, Guernsey, the Isle of Man, the Faroe Islands, Israel, Japan, Jersey, New Zealand, the United Kingdom and Switzerland. The United States is not on that list, and that same resolution withdrew the Privacy Shield as an enabling instrument. We tell you because the infrastructure hosting the platform is in the United States.

What the transfer rests on, then. On the two doors article 23 itself opens and that fit this contract: letter A), your unequivocal consent to the transfer, which is what we ask you for on the consent screen, naming the destination before the datum leaves; and letter B), that the transfer is necessary to perform the contract between you and us, which is what the Service is. And we do not stop there: the same article accepts that the safeguards «may derive from appropriate contractual clauses», and URCDP Resolution N° 41/021, of September 8, 2021, recommended those of its Annex I. Those clauses are not prose in this annex: they are the data processing agreement your firm accepts, published as an instrument of its own, with the list of sub-processors named inside it.

Of the other countries where the Service is offered, only Argentina is on that list. Colombia is not, nor Ecuador, nor the Dominican Republic, nor Costa Rica, nor Brazil. It matters the day a Uruguayan firm shares data with a firm from one of those five countries inside the platform: that transfer needs its own basis under article 23, and this annex does not take it for granted.

The data of your firm's clients and counterparties is another matter. Over it the controller is you and we are your processor, acting on your instruction; it is you who has the relationship with the data subject and who obtains what article 23 requires. That is what you declare when you accept the third-party data declaration.

The impact assessment is the entry obligation, and it is done. Article 6 of Decreto N° 64/020 requires the impact to be assessed before processing starts when, among other cases, a stable processing of «data linked to the commission of criminal, civil or administrative offences» may be projected (letter b) or data may be transferred to States without an adequate level of protection (letter f). Both reach the Service from the first Uruguayan firm: a court case file is the former and the infrastructure in the United States is the latter. The assessment, with the minimum content of article 7, lives in Custodio Legal's internal security documentation and is reviewed when what it describes changes. Should it reveal «a potential and significant risk» to the rights of data subjects, that same article requires it to be brought to the URCDP's attention with the detail of the measures, and we would do so.

The data protection officer is not an entry condition, and we say why. Article 40 of Ley N° 19.670 and article 10 of Decreto N° 64/020 require one from public entities, from private entities processing sensitive data as their principal business and from those processing large volumes of data. The regulation closes both: sensitive data is that of article 4, letter E), of Ley N° 18.331 — racial and ethnic origin, political preferences, religious or moral convictions, trade union membership, health and sex life — and a civil, commercial or employment case file is none of those categories even if it may contain one; and the large volume is defined with a number, «more than 35,000 persons». Neither case is met today. The second is a threshold crossed without warning, and what crosses it is the count of distinct data subjects, not of firms. We measure it, and this is how: every day we count the distinct data subjects we process in each country, and we warn our compliance officer when the Uruguayan count reaches 80 % of those 35,000 persons and again when it crosses them. We count people and not firms, with the same criterion we use to identify whoever exercises their rights — name and document when there is a document, name when there is not — so the number is approximate in both directions and we treat it as an early signal and not as an exact figure. The day it is crossed there are 90 days to communicate the appointment (article 14 of the same decree) and the officer must evidence legal knowledge specialised in data protection (article 12). This annex would say so before it happens.

When the relationship with a firm ends we notify its owner after sixty (60) days and suppress its data after ninety (90); the thirty days in between are the margin to come back.

Those two windows are platform policy, and Uruguayan law does not contradict them — it is the only country of the Service whose statute sets an explicit ceiling. Article 30 of Ley N° 18.331 orders that «once the contractual performance is complete the personal data processed must be destroyed», and allows it to be kept «for a period of up to two years» only with the express authorisation of the party on whose behalf the services were provided. We do not ask you for that authorisation and we do not use it: ninety days sit comfortably below that ceiling and do not need it.

The line between the two hats, which is the part that matters. Over the data your firm uploads — its clients, its counterparties, its case files — we are the processor and the whole of article 30 runs on us, including its first prohibition: not to apply it to a purpose other than the one stated in the services contract «nor to assign it to other persons, not even for its safekeeping». That is why every third party processing that data on our behalf is named in the data processing agreement, and not merely published in the sub-processor list: publishing it is not enough in Uruguay. Over the data of your firm's account — its owner, its billing, its consent log — we are the controller, and there article 8 applies: the datum is deleted when it ceases to be necessary or relevant for the purpose that motivated obtaining it.

What survives the suppression, and why:

• The proof of your authorisation and of the processing — the consent log and the audit log — because article 9 requires consent to be documented and article 12, in the wording of Ley N° 19.670, requires the controller and the processor to demonstrate the effective implementation of their measures.
• The data subject rights requests and their resolution, which are the proof of having handled them within the five business days of articles 14 and 15.
• The billing trail, which is data about your firm as our customer and not data processed on your behalf: we keep it for as long as it is necessary for the relationship and to be able to prove it (articles 8 and 12). We still do not promise you a period, and we can now say why with more precision. The Uruguayan tax period was read: article 70, letter C), of the Código Tributario (Ley N° 14.306) orders books, documents and records to be kept in an orderly manner «during the limitation period of the tax», and article 38 sets that period at five years counted from the end of the calendar year in which the taxable event occurred, extended to ten in the cases that same article lists. That duty is the Uruguayan taxpayer's — your firm, when it has to withhold on the payment abroad — and not ours: Custodio Legal is not a taxpayer in Uruguay, so that article gives us no period to promise you. The commercial period is still unread from official sources, now with the reason written down: IMPO does not publish the text of the Código de Comercio without a subscription, and the Parliament site did not answer. When it is read, this annex brings the number with its article.

Custodio Legal, holder of tax number NIT 1057602936 of the Republic of Colombia, with legal domicile at Carrera 17 #2-81, Sogamoso, Boyacá, Colombia, provides the Service. You can write to us at [email protected] or call +57 333 431 8597; the team that handles enquiries and complaints is the Personal Data Protection Area, at that same email address.

We have no establishment and no representative domiciled in Argentina. This section is here under its own heading, and not as a pointer to the trunk, because Resolución AAIP 126/2024 lists among its very serious infringements «omitir denunciar, con motivo del tratamiento de datos personales en Internet, el domicilio legal y demás datos identificativos del responsable, sea ante el Registro Nacional de Bases de Datos como así también en su política de privacidad, de modo tal que mediante dicha conducta afecte el ejercicio de los derechos del titular del dato y la actividad de contralor» of the authority. The offence needs both halves —the omission and its effect— and that is why we are not interested in arguing whether a given case would complete it: we tell you who we are and where we are.

The processing of personal data of data subjects domiciled in Argentina is governed by Ley 25.326 on the protection of personal data, of October 4, 2000, and by its implementing Decreto 1558/2001.

The supervisory authority is the Agencia de Acceso a la Información Pública (AAIP). It is the authority you complain to if you are not satisfied with what we do, and you can also write to us at [email protected].

Article 44 of the law says two different things and both reach you. First, that its chapters I to IV «son de orden público y de aplicación en lo pertinente en todo el territorio nacional» (are of public order and apply throughout the national territory). And then, in a separate sentence, that «la jurisdicción federal regirá respecto de los registros, archivos, bases o bancos de datos interconectados en redes de alcance interjurisdiccional, nacional o internacional» (federal jurisdiction shall govern registers, files or databases interconnected in networks of inter-jurisdictional, national or international reach). The Service is exactly that: twenty-four provincial regimes do not apply to you, one does.

Two things about this regime differ from the other countries where the Service is offered, and they are worth saying here:

• Legal persons are data subjects. Article 2 defines the data subject as «toda persona física o persona de existencia ideal con domicilio legal o delegaciones o sucursales en el país» (any natural person or legal entity with legal domicile, branches or subsidiaries in the country). Your firm, if it is a company, is itself a data subject and not only responsible for third parties' data: it can exercise against us the same rights an individual exercises.
• Consent is by default express and in writing, not tacit. Article 5 paragraph 1 says it must be given «por escrito, o por otro medio que permita se le equipare, de acuerdo a las circunstancias» (in writing, or by another means that can be treated as equivalent, according to the circumstances).

Article 3 of Ley 25.326 says that the formation of data files «será lícita cuando se encuentren debidamente inscriptos» (shall be lawful when they are duly registered). This is not a formality separate from lawfulness: it is the lawfulness. And article 21 requires registration in the register the authority sets up, declaring —among nine other things— the purpose of the file, the nature of the data, the recipients and how long the data is kept.

Article 21 paragraph 1 names private files «destinados a proporcionar informes» (intended to provide reports), which could be read as if it only reached those who sell information. It does not, and what closes the question is article 1 of Decreto 1558/2001: private files are within that concept when they «exceden el uso exclusivamente personal» (exceed exclusively personal use) or have the transfer of personal data as their purpose, whether the information circulates for a fee or free of charge. A platform that processes the matters of several firms exceeds exclusively personal use, so the register reaches us. We say it here because the opposite reading would be the convenient excuse.

The register is the AAIP's Registro Nacional de Bases de Datos, and registration runs on two sides:

• Yours, for your own database: your case files and your clients' data are your file, and you are its controller.
• Ours, through the route the AAIP opened for controllers not established in Argentine territory. It is a web form with the character of a sworn statement, free of charge and with no expiry, which asks for the company's articles of incorporation and an authorised person or attorney-in-fact, and which asks for neither a CUIT nor a tax key.

What state our filing is in today: it has not been submitted. We do not say "in progress" or "coming soon": the registration has not been started, we have no resolution number and therefore there is no number to cite to you. The day one exists, this annex publishes it with its date and goes up a version.

And what it means today, said with the gravity it has and not with the one that sounds better. Anexo I of Resolución AAIP 126/2024 has two entries about this, and the one that describes our situation is the milder: it is a minor infringement to «efectuar tratamiento de datos personales sin encontrarse inscripto ante el Registro Nacional de Bases de Datos en infracción a lo dispuesto por el artículo 3° de la Ley N° 25.326», and a serious one to fail to register «cuando haya sido requerido para ello» (when the authority has required it). No such requirement has been made. What does not depend on the gravity, and is what really matters, is article 3: while it is not registered, the formation of the file is not lawful, and that is not fixed by paying a fine.

We tell you this here and not in a footnote because article 14 of Decreto 1558/2001 gives you the right to ask us: literal f) includes within the right of access «saber si el archivo está registrado conforme a las exigencias de la Ley Nº 25.326» (knowing whether the file is registered as Ley No. 25.326 requires). If you ask us today, the answer is the one in this paragraph.

And because paragraph 3 of article 21 is a living obligation and not one of registration alone: no user may hold data of a nature different from the one declared. What we declare in the register has to say the same as this annex, including the retention period.

Article 5 paragraph 2 of Ley 25.326 lists the cases in which consent is not necessary, and two of them are what hold up the entire Service. We cite them with their wording instead of summarising them:

• Literal a), «fuentes de acceso público irrestricto» (sources of unrestricted public access). This is what holds up judicial surveillance. What the Service reads from a case file —the caption, the published parties, the filings— is published by a judiciary's portal for anyone, with no registration and no password.
• Literal d), data that «deriven de una relación contractual, científica o profesional del titular de los datos, y resulten necesarios para su desarrollo o cumplimiento» (derive from a contractual, scientific or professional relationship of the data subject, and are necessary for its development or performance). This is what holds up your firm's case file: the data of your clients, of their counterparties and of the third parties who appear in their matters derive from your professional relationship with them and are necessary to carry it on.

Outside those two cases paragraph 1 applies and consent has to be free, express and informed, in writing or by an equivalent means. Your acceptance of this policy and of the processing agreement on the platform is frozen, with its date and its full text, in an immutable row of our consent log; that is the equivalent means with which we answer if it ever has to be proved.

There is a third piece that is not a legal basis but a warning. Article 11 paragraph 4 says that the transferee «quedará sujeto a las mismas obligaciones legales y reglamentarias del cedente y éste responderá solidaria y conjuntamente por la observancia de las mismas» (shall be subject to the same legal and regulatory obligations as the transferor, and the latter shall be jointly and severally liable for their observance) before the authority and before the data subject. It is a rule per transfer, and in this relationship there are two chained: you transfer to us and we transfer to each subprocessor. It is developed in the subprocessors section below, because in Argentina it reaches you.

This annex separates two kinds of processing that Argentine law subjects to different articles, and no other annex of the Service separates them that way.

What we process on your behalf —the case file, the parties, the documents you upload and the text we extract from them— makes us processors under article 25 of Ley 25.326. Over that data we decide nothing: it is not applied to a purpose other than the one stated in the contract, it is not transferred to anyone «ni aun para su conservación» (not even for its safekeeping), and it is destroyed once the service is performed. That is what the Argentine processing agreement develops clause by clause.

Your account data —the name, email and phone of the person who signed up, the consent log, your rights requests and the billing trail— makes us controllers. Nobody entrusted it to us: we collected it ourselves in order to provide you the Service. That processing does not fall under article 25 but under article 4 paragraph 7 —data «deben ser destruidos cuando hayan dejado de ser necesarios o pertinentes a los fines para los cuales hubiesen sido recolectados» (must be destroyed when they have ceased to be necessary or relevant to the purposes for which they were collected)— and under article 16 paragraph 7, which subjects it to the periods of the applicable provisions or of the contract.

They are two different retention regimes, and the retention section of this annex counts them separately.

Ley 25.326 does set deadlines, and it sets two different ones, with two different units. It is the only country of the Service where that happens:

Right	Deadline	Unit	From	Rule
Access	ten (10) days	calendar	the formal demand	Ley 25.326, art. 14 para. 2
Rectification, updating, erasure and blocking	five (5) days	business	receipt of the claim	Ley 25.326, art. 16 para. 2

Objection and portability do not exist as autonomous rights in the Argentine regime. It is not that we fail to handle them: the law does not name them and therefore there is no term to count. If you ask us for either of the two we tell you that, and we tell you what we can do.

Two more things the law gives you and that we would rather you read here:

• Access is free at intervals of no less than six months, unless you show a legitimate interest (art. 14 para. 3). If you ask us for a second access sooner, we tell you so citing the article, and if you substantiate the interest we grant it anyway.
• If we rectify or erase data we had already transferred, we have to notify the transferee within the fifth business day (art. 16 para. 4). That propagation is not executed by the platform yet: we do it by hand, with a record, and it is written as such in our internal manual.

Once either of the two deadlines expires, the law does not send you to complain: it lets you sue. Article 14 paragraph 2 says that «quedará expedita la acción de protección de los datos personales o de hábeas data» (the personal data protection or habeas data action shall become available), and article 16 paragraph 3 says that non-compliance «habilitará al interesado a promover sin más» (shall entitle the interested party to bring, without further ado) that same action. There is no prior instance to exhaust.

Those deadlines are not computed by the platform yet, and we would rather tell you: counting Argentine business days requires the calendar of public holidays and judicial recesses, which is not loaded yet. In the meantime your request is filed all the same and we handle it, with the due date marked as estimated and not as certain.

Ley 25.326 imposes no general duty today to notify a security breach, neither to you nor to the authority. We do not say it by omission, we say it as an assertion and with its verification:

• Resolución AAIP 47/2018, which approves the security measures for the processing of personal data, sets them out «de modo referencial» (by way of reference) and as recommended; its security incident section speaks of detecting, assessing, containing and responding to them, and does not mention notifying anyone.
• The catalogue of infringements of Resolución AAIP 126/2024 —minor, serious and very serious— does not classify failure to notify an incident as an infringement.
• The duty to notify breaches is new in the reform bill, which has not been enacted. We do not promise it to you as a right in force, because it is not.

What we do, by contract and not because an Argentine statute requires it, is tell you: clause 5 literal i) point ii) of the processing agreement we sign with you obliges us to notify you «sin demora» (without delay) of any accidental or unauthorised access. The notice reaches you with the date and time the incident occurred, not only that of its detection.

What that notice enables you to do is yours and not ours: you decide, as the controller of your database, what you communicate to your data subjects.

And the duty of security is mandatory, even though the catalogue of measures is recommended: article 9 of the law requires the adoption of the necessary technical and organisational measures, and article 25 literal b) of Decreto 1558/2001 says expressly that that article 9 «incumbe también al encargado del tratamiento» (also falls upon the processor).

Operating the Service means transmitting your data outside Argentine territory. The platform's infrastructure is in the United States.

Article 12 paragraph 1 of Ley 25.326 prohibits transferring personal data to countries that do not provide adequate levels of protection, and none of the five exceptions in its paragraph 2 covers hosting data in a foreign cloud.

The United States is not on the list of adequate countries. That list is article 3 of Disposición DNPDP 60-E/2016, in the wording given to it by Resolución AAIP 34/2019, and it names the member States of the European Union and of the European Economic Area, the United Kingdom, Switzerland, Guernsey, Jersey, the Isle of Man, the Faroe Islands, Canada only as regards its private sector, Andorra, New Zealand, the Oriental Republic of Uruguay and Israel only as regards data that undergo automated processing. Colombia, Ecuador, the Dominican Republic, Costa Rica and Brazil are not on it either.

The route we use is the one opened by article 12 of Decreto 1558/2001, which recognises an adequate level when the protection derives «del amparo que establezcan las cláusulas contractuales que prevean la protección de datos personales» (from the shelter established by contractual clauses providing for the protection of personal data): the data processing agreement we sign with your firm, which reproduces Annex II of Disposición 60-E/2016 exactly as the authority publishes it. That contract is the instrument of the transfer, and that is why it is accepted together with this policy and not afterwards.

There is a second route that covers one specific part and that is also in that article: no consent is needed to transfer data «desde un registro público que esté legalmente constituido para facilitar información al público» (from a public register legally constituted to provide information to the public). That is what covers what the Service copies from a judicial portal.

The list of the third parties that process data on our behalf, with the country they do it from and what they receive, is published in the Service's subprocessor list and travels attached to the processing agreement every time you accept it, not linked from outside: what is frozen with your acceptance is the text of the contract plus the list in force that day.

In Argentina that is not a courtesy, and the reason has an article. Article 25 paragraph 1 forbids the processor to transfer the data to other persons «ni aun para su conservación» (not even for its safekeeping) beyond what the service contract says, and clauses 5 ll), 5 n) and 10 a) of Annex II require informing you beforehand, obtaining your written consent and sending you without delay a copy of the contract with the subprocessor. Clause 10 d) obliges you to keep that list, updated at least once a year, and to make it available to the authority.

And article 11 paragraph 4 closes the picture, though it is worth reading slowly because it is a chain and not a leap. The rule says the transferee is subject to the same obligations as the transferor «y éste responderá solidaria y conjuntamente por la observancia de las mismas» (and the latter shall be jointly and severally liable for their observance). Applied twice —you transfer to us, we transfer to a subprocessor— you answer together with us and we answer together with it. Put bluntly: each subprocessor of ours ends up being your risk. That is why we name them one by one in the contract instead of hiding them behind a link, and why we do not take on a new one without telling you before it processes your data.

What does soften that chain, and we say it because it plays in your favour: the last paragraph of article 11 of Decreto 1558/2001 says the transferee «podrá ser eximido total o parcialmente de responsabilidad si demuestra que no se le puede imputar el hecho que ha producido el daño» (may be relieved in whole or in part if it shows the act that caused the damage cannot be imputed to it). The joint liability is neither strict nor automatic.

Two figures that exist in other countries of the Service do not exist in the Argentine regime, and we say it as an assertion and not by omission:

• There is no data protection officer. Neither Ley 25.326 nor Decreto 1558/2001 regulates the figure: there is no duty to appoint one, there is no threshold of data subjects that triggers it and there is no register of officers. The figure appears in the reform bill, which has not been enacted. Who handles your enquiries and your complaints is the Personal Data Protection Area of the section above.
• There is no mandatory prior impact assessment. Neither of the two rules requires one either. We carried one out anyway for the processing with artificial intelligence and for Uruguay, where it is mandatory, and that work is done; but we do not tell you that an Argentine rule requires it of us, because that is not true.

What is mandatory, and we comply with it, is the duty of security of article 9 and the duty of confidentiality of article 10, which subsists «aun después de finalizada» (even after it has ended) the relationship with the owner of the file.

The three figures Argentina does not require —the officer, the duty to notify a breach and the impact assessment— we checked again on September 12, 2026, and we do not take them as settled from an earlier reading: neither of the two words that name the officer appears in the text of Ley 25.326 or of Decreto 1558/2001, nor does the impact assessment; and the consolidated text of the law that InfoLEG publishes carries no note of repeal or replacement. All three would be mandatory under the reform bill, which on that date has four live files and no chamber approval. The day that changes, this annex changes and its version goes up.

When the relationship with a firm ends we warn its owner at sixty (60) days and erase its data at ninety (90); the thirty days in between are the margin to come back.

Those two windows are platform policy, and Argentine law does not contradict them: over the data your firm loads —its clients, its counterparties, its case files— we act on your behalf, and article 25 paragraph 2 of Ley 25.326 orders them destroyed «una vez cumplida la prestación contractual» (once the contractual service has been performed), allowing them to be kept «por un período de hasta dos años» (for a period of up to two years) only with your express authorisation. We do not ask you for that authorisation and we do not use it: ninety days sit comfortably below that cap.

Once the erasure is done we hand you the certificate of destruction, and we do not file it only for ourselves: clause 12 of the processing agreement obliges us, at your choice, to return the data to you or to destroy it «certificando tal hecho» (certifying that fact).

What outlives the erasure, and why:

• The proof of your authorisation and of the processing —the consent log and the audit log—, because article 5 requires consent to be given in writing or by an equivalent means, and because articles 9 and 10 oblige the controller and the processor to be able to evidence the security and confidentiality measures they adopted.
• The data subject rights requests and their resolution, which are the proof of having handled them within the ten calendar days of article 14.2 and the five business days of article 16.2.
• The billing trail, which is data about your firm as our client and not data processed on your behalf: we keep it for as long as it is necessary for the relationship and to be able to prove it, under article 4 paragraph 7 and article 16 paragraph 7.

On that last point there is an Argentine ten-year period, and it is not ours. Article 328 of the Código Civil y Comercial requires books, other records and supporting instruments to be kept for ten years, and article 33 of Ley 11.683 empowers the federal tax administration to require that the vouchers of transactions be kept for that same term. Both bind whoever keeps accounting books or pays taxes in Argentina — it is your term, not ours: Custodio Legal keeps no Argentine accounting books and is not a taxpayer there. That is why we cite you the rule, which may govern what you have to keep of this relationship, and we promise you no term of our own for the billing trail: it would mean inventing an obligation we do not have in order to justify a retention that has no number.

Custodio Legal, identified with NIT 1057602936 of the Republic of Colombia, with legal domicile at Carrera 17 #2-81, Sogamoso, Boyacá, Colombia, provides the Service. You can write to us at [email protected] or call us at +57 333 431 8597.

We have no establishment or representative domiciled in Brazil. The LGPD reaches us all the same, and we say so because it is worth your knowing: its art. 3º, II applies it to any processing whose purpose is to offer goods or services to people located in the national territory, and art. 11 § 2º of the Marco Civil da Internet reaches the foreign legal entity that offers a service to the Brazilian public.

Over your firm's data —your account, your billing, your consent log— we are the controller. Over the data your firm uploads into its matters —its clients', its opposing parties' and the third parties who appear in them— we are the operator: we process it on your behalf and on your instruction, and you are the controller. That second processing is governed by the cláusulas-padrão contratuais of Anexo II of Resolução CD/ANPD nº 19/2024, which we sign with you in the data processing agreement.

There is no encarregado designated, and it is not an oversight. Art. 41 of the LGPD says «o controlador deverá indicar encarregado»: the duty is the controller's, and the operator does not appear in the text. Art. 6º of Resolução CD/ANPD nº 18, of July 16, 2024, closes it in so many words: «A indicação de encarregado por operadores é facultativa e será considerada política de boas práticas de governança». The contact channel exists all the same and it is [email protected].

There is something this annex does not claim, and it is worth saying: we are not an «agente de tratamento de pequeno porte» in the sense of Resolução CD/ANPD nº 2/2022. Its art. 2º, II requires registration in a Brazilian commercial registry, which a Colombian company does not have, and its art. 3º, I takes out of the regime anyone carrying out high-risk processing, which we fall into through our use of artificial intelligence. We do not claim a benefit that is not ours.

The processing of personal data of data subjects domiciled in Brazil is governed by Lei nº 13.709, of August 14, 2018 — Lei Geral de Proteção de Dados Pessoais (LGPD).

The supervisory authority is the Agência Nacional de Proteção de Dados (ANPD), which has been a regulatory agency since Lei nº 15.352, of February 25, 2026, which gave new wording to art. 55-A of the LGPD and to art. 5º, VIII. It is before the ANPD that you complain if you are not satisfied with what we do, and you can also write to us at [email protected].

A data subject is always a natural person. Art. 5º, V of the LGPD says so, and it is not a drafting detail: a legal entity does not hold data protection rights in Brazil, unlike in Argentina and Uruguay. The rights this annex describes belong to natural persons.

The legal bases for processing are named, not inferred. Art. 7º of the LGPD lists the hypotheses, and three govern us:

• Art. 7º, V —performance of the contract with the data subject— supports the processing of your account data and of the people in your firm.
• Art. 7º, VI —«para o exercício regular de direitos em processo judicial, administrativo ou arbitral»— supports the processing of the data of parties, opposing parties and third parties who appear in a matter. It is not our reading of a general principle: it is written in those words, and it is the hypothesis a matter occupies exactly.
• Art. 7º, II —compliance with a legal or regulatory obligation— supports what we keep because a rule requires it, and it is in the retention section.

Over all of them run the principles of art. 6º: purpose, adequacy, necessity, free access, quality, transparency, security, prevention, non-discrimination and demonstrated accountability.

The duty that falls on us as operators is in art. 37: keeping a record of the processing operations we carry out. It is a standalone obligation, not derived from the contract, and it is not a filing with the authority: it is our own, and producible when the ANPD asks for it. Brazil has no register of databases before the authority, unlike Argentina and Uruguay.

The Service reads what the courts publish about a matter in the public e-SAJ case lookups it watches. It is worth saying under what condition, because Brazilian law does not say that public data is free.

Art. 7º, § 3º of the LGPD requires that the processing of publicly accessible personal data «deve considerar a finalidade, a boa-fé e o interesse público que justificaram sua disponibilização», and § 7º repeats the condition for any subsequent processing. It is a condition, not a permission.

What we do falls within that purpose, and we describe it so you can judge it: we read the docket of the matters your firm points us to, so as to alert you to their movements and calculate their deadlines. That is the reason the court publishes the docket.

What we do not do, and this is not a vague promise but the limit the rule imposes: we do not build commercial profiles of the parties with that data, we do not sell it, we do not hand it to third parties outside the provision of the Service and we do not use it to train artificial intelligence models.

Art. 18 of the LGPD gives you, against the controller: confirmation that processing exists; access to the data; correction of incomplete, inaccurate or out-of-date data; anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law; portability to another provider; deletion of data processed with your consent, save for the exceptions of art. 16; information about the entities with which data was shared; information about the possibility of not giving consent and its consequences; and withdrawal of consent. § 1º adds the right to petition the ANPD.

The deadlines, with the rule that sets them:

Right	Deadline	Rule
Confirmation that processing exists, and access, in simplified form	immediate	LGPD, art. 19, I
Access by clear and complete statement	fifteen (15) calendar days from your request	LGPD, art. 19, II
The other rights of art. 18	fifteen (15) calendar days	Clause 15.3 of Anexo II of Resolução CD/ANPD nº 19/2024

The fifteen days are calendar days and not business days: neither art. 19, II nor Clause 15.3 says «úteis», and Resolução nº 15/2024 does say it when it means it.

There is an asymmetry we would rather tell you than hide: the only deadline the law sets is the one for access. For the other rights, art. 18 § 5º refers to a regulation, and as of the date of this annex we did not find that regulation published. The fifteen days we apply to every right come from the contract the ANPD itself drafted —Clause 15.3 of its cláusulas-padrão—, not from the law, and that is why we can promise them without inventing anything.

If the request reaches us and the controller is your firm. Art. 18 § 3º allows the request to be addressed to any processing agent, the operator included. When that happens, art. 18 § 4º, I gives us the exact way out and we use it: we reply that we are not the agent that decides about that data, we tell you which one is —the firm— and we pass the request on immediately, so it can answer you in time. Clause 15.4 of Anexo II requires the same.

If a security incident occurs that may entail relevant risk or damage to data subjects, we give notice.

The Brazilian clock is short and it has to be stated in hours. Art. 6º of Resolução CD/ANPD nº 15, of April 24, 2024, gives the controller three (3) business days to report the incident to the ANPD, counted from when it knows the incident affected personal data, and art. 9º gives it the same period to report it to the data subjects. That deadline is the controller's —your firm, as to the data it uploads—. Ours is to warn you well before that clock starts squeezing you, with the information you need to comply with it, and to be able to prove when we warned you. Our commitment is to contact you within twenty-four (24) hours of learning that an incident affected your firm's personal data.

In Brazil an incident involving a firm's data is always reportable, and that is not to be argued case by case: art. 5º, V of that resolution declares relevant those incidents involving «dados protegidos por sigilo legal, judicial ou profissional», which is exactly what a matter contains. Art. 7º, II of Lei nº 8.906/1994 covers the lawyer's working instruments and electronic correspondence with inviolability, and its art. 34, VII makes breaking professional secrecy a disciplinary offence.

What the report must contain. Art. 6º § 2º sets out its content, and one of its items names us: item X asks for «a identificação do operador, quando aplicável». That is where we appear, and we give you in writing what you need to fill it in. § 3º allows the information to be completed within twenty (20) business days from the report, and art. 9º § 3º requires that, when individual communication to the data subjects is unfeasible, the public disclosure last at least three months.

The incident log is ours and it lasts five years. Art. 10 of the same resolution requires the incident record to be kept for a minimum of five years, and expressly includes incidents that were not reported. Clause 16.2 of Anexo II places that duty on the importer, that is, on us, and we comply with it.

Operating the Service means transmitting your data outside Brazilian territory.

The route is that of art. 33, II, b) of the LGPD: the cláusulas-padrão contratuais that the ANPD approved in Anexo II of Resolução CD/ANPD nº 19, of August 23, 2024, which we sign with your firm in the data processing agreement. That model is adopted whole and unaltered: art. 16 of that resolution says the validity of the transfer «pressupõe a adoção integral e sem alteração do texto disponibilizado no Anexo II», and its § 2º forbids any other clause of our contracts from excluding, modifying or contradicting it «direta ou indiretamente».

Why not the adequate-country route. Art. 33, I allows transfers to countries with an adequate level of protection, and that adequacy is declared by the ANPD through a Resolução published on its site (art. 13 of the Regulamento). We looked for that publication and the only one that exists does not reach Colombia: the ANPD recognised the European Union as an adequate international organism through Resolução nº 32, of January 26, 2026, and its own site says it will update the list «conforme outras decisões como essa forem emitidas». No country in the Americas is on it. So that route is not available for this transfer, and even if one appeared, the signed contract would remain standing: an adequacy decision can be revoked, a contract cannot.

And why not the item IX route either. Art. 33, IX allows the transfer «quando necessário para atender as hipóteses previstas nos incisos II, V e VI do art. 7º», and item VI is precisely the regular exercise of rights in judicial proceedings. Read alone, it would seem that a platform like this one can transfer with no contract at all. It is not so: art. 9º of the Regulamento requires both things at once —a legal hypothesis of art. 7º and a valid transfer mechanism—, and anyone using item IX as a substitute for the contract is reading half the rule.

What that contract obliges us to do, and what this annex states because it affects you:

• The forum is Brazilian. Clause 24.1 submits any dispute to the competent courts of Brazil, and 24.2 allows the data subject to sue us before the court of their own residence. Clause 24.3 only admits arbitration held in Brazil.
• If an authority asks us for access to your data, we tell you. Clause 19.1 obliges us to notify you and the data subject, unless the law of the country of processing forbids the notification; and 19.2 obliges us to take legal measures, court actions included, when there is ground to challenge the lawfulness of the request. We also keep the log of those requests that Clause 19.3 requires, with the date, the requester, the purpose, the type of data, how many times it arrived and what we did.
• We answer for our sub-processors as if they were us. Clause 18.2, c) makes us «responsável por eventuais irregularidades praticadas pelo terceiro destinatário», and 18.2, b) obliges us to guarantee by written contract that the safeguards reach them. The list of who they are, with their role and the jurisdiction where the data ends up, travels attached to the data processing agreement every time it is accepted.
• Everything made available to the data subject is in Portuguese. Clause 14.4 requires it. That is why the data processing agreement has its official text in Portuguese, and the Spanish and English versions are courtesy translations.

When the relationship with a firm ends we notify its owner at sixty (60) days and delete its data at ninety (90); the thirty days in between are the margin to come back.

Those two windows are platform policy, and Brazilian law does not contradict them: art. 16 of the LGPD requires personal data to be deleted at the end of its processing and authorizes keeping it —among other things— for compliance with a legal or regulatory obligation of the controller. Clause 20 of Anexo II repeats the four listed exceptions.

What survives deletion, and why:

• The proof of your authorization and of the processing —the consent log and the audit log—, because art. 37 obliges the controller and the operator to keep a record of the processing operations they carry out, and because the burden of proving that consent was obtained rests on the controller (art. 8º § 2º).
• The application access logs, which art. 15 of the Marco Civil da Internet (Lei nº 12.965/2014) requires to be kept under secrecy, in a controlled and secure environment, for six (6) months. It is best not to read it backwards: it is a minimum retention period, not a deadline to delete. And its § 3º says what really matters: those logs are handed over only by court order. We invoke that article directly, and not the «compliance with a legal obligation» exception of the data processing agreement, because that obligation is the controller's and this one is ours.
• The security incident log, including the incidents that were not reported, for the minimum of five (5) years of art. 10 of Resolução CD/ANPD nº 15/2024.
• The log of authority access requests of Clause 19.3 of Anexo II. The rule sets no period for it and the ANPD or your firm may ask for it at any time, so we keep it and we do not promise you a deletion date the rule does not give.
• Data subject rights requests and their resolution, which are the proof of having answered them within the fifteen days of art. 19, II.
• The billing trail, which is data about your firm as our customer and not data processed on your behalf: we keep it for as long as it is necessary for the relationship and to be able to prove it. We do not promise you a period, and now we know why we cannot: we did not read the Código Tributário Nacional in an official source, and the Brazilian period we did read —the five years of art. 206, § 5º of the Código Civil for the fee claims of liberal professionals— is a period of your firm against its clients, not ours against you. Writing it here as if it were ours would be citing a rule that does not govern this relationship.

We do not anonymize the audit log on a fixed schedule, and that is a statement and not an oversight: no Brazilian rule we read sets how long the personal data of an audit line lives. The six months of the Marco Civil are the opposite —a retention floor— and the five years of Resolução nº 15/2024 belong to the incident log. Writing a window with no rule behind it would be inventing it.