Legal

Terms and Conditions and Personal Data Processing Policy

Version 2026-10-04 · Effective October 4, 2026 · Applies to nivosaas.lat, app.nivosaas.lat and the Nivo services.

Note: this document contains the general contracting conditions for the Nivo services (Part I) and the Personal Data Processing Policy (Part II). The particular conditions agreed in each Service Order prevail over those set out here to the extent they are incompatible. Translation for convenience; the Spanish version prevails.

1. Purpose and scope

These Terms and Conditions (the “Terms”) govern access to and use of the nivosaas.lat website, the dashboard available at app.nivosaas.lat, the public pages linked to the NFC tags and QR codes, and the provision of the services offered under the Nivo brand.

Part II of this document, beginning at section 29, contains Nivo’s Personal Data Processing Policy, issued in compliance with Colombian Statutory Law 1581 of 2012 and Chapter 25, Title 2, Part 2, Book 2 of Single Regulatory Decree 1074 of 2015, which compiled Decree 1377 of 2013.

These Terms bind every person who accesses the channels mentioned above, as a Contracting Business, Authorized User or End Customer, to the extent applicable to each.

2. Identification of the provider

The Service is provided by the owner of the Nivo brand (hereinafter, “Nivo”), whose name or corporate name, identification number and domicile appear in the Service Order and are provided to any data Subject or authority that requests them through the channels indicated in this section.

Service channels: email admin@nivosaas.lat, WhatsApp +57 304 452 9157 and the page nivosaas.lat/soporte. Commercial matters and contractual notices: admin@nivosaas.lat.

3. Definitions

The following capitalized terms have the meaning given below, in the singular or plural:

Service: the Nivo platform as a whole, including the website, the Dashboard, the public pages, the Tags, the third-party integrations and the contracted Nivo Services.
Nivo Services: Nivo Reviews, Nivo Loyalty, Nivo Social and, when offered, Nivo Payments, described in section 5.
Contracting Business: the individual or legal entity that contracts one or more Nivo Services for its establishment.
Authorized User: the person to whom the Contracting Business gives Dashboard credentials or the checkout scanner link.
End Customer: the person who, as a consumer of the Contracting Business, interacts with its Tags, leaves a review or joins its loyalty program. The End Customer is not a party to the contract between Nivo and the Contracting Business.
Service Order: the document, data message or accepted proposal stating the contracted Nivo Services, the plan, the price, the activation date and any particular conditions.
Dashboard: the web application the Contracting Business accesses with its own credentials.
Tag: the NFC label, QR code and printed material that lead to the public pages of the Service.
Digital Pass: the loyalty card the End Customer saves in Google Wallet or Apple Wallet.
Trial Period: the temporary use of the Service agreed in writing under section 13.
Personal Data, Data Subject, Processing, Controller, Processor, Authorization, Transfer and Transmission: have the meaning given to them by Law 1581 of 2012 and Decree 1074 of 2015.
Parties: Nivo and the Contracting Business.

4. Acceptance and formation of the contract

The contract between Nivo and the Contracting Business is formed upon acceptance of the Service Order, whether by handwritten signature, electronic signature, email, WhatsApp message or any other data message, all of which have full validity and evidentiary value under Colombian Law 527 of 1999. Accepting the Service Order implies full acceptance of these Terms.

Whoever accepts on behalf of a legal entity or a third party represents that they have sufficient authority to bind it. Whoever accepts must be of legal age and fully capable.

In case of conflict, the following order of precedence applies: (i) the particular conditions of the Service Order; (ii) these Terms; and (iii) technical annexes, guides or instructions.

The End Customer accepts Part II of this document by ticking the authorization box on the enrollment form. Simply browsing the website implies acceptance of the usage rules applicable to it.

5. Description of the Nivo Services

Each Nivo Service is independent and may be contracted separately or together with others. The specific scope of the Service is the one stated in the Service Order:

Nivo Reviews: Tags that take the End Customer to the Contracting Business’s official Google review form; aggregate measurement of taps; monitoring of public reviews; draft replies and periodic reports.
Nivo Loyalty: voluntary enrollment of End Customers in the Contracting Business’s visits-and-rewards program, issuance of the Digital Pass, web scanner for the checkout, management of rewards and redemptions, metrics and draft messages for End Customers who have authorized receiving promotions.
Nivo Social: Tags that take the End Customer to the Contracting Business’s Instagram profile, measurement of taps, account statistics when the Contracting Business connects it through Meta, and recommendations generated with artificial intelligence.
Nivo Payments: service under development. It is not part of any current offer until Nivo expressly announces it and it is included in a Service Order.

Depending on the plan, the Service may include physical Tags, design of printed material, initial training, Dashboard access and support. Nivo may improve or modify features provided it does not reduce the essential contracted services.

Nivo’s obligations are obligations of means, not of result. Nivo does not guarantee any number of reviews, rating, follower count, visits or sales, since these depend on the free decision of End Customers and on factors beyond Nivo’s control.

6. Obligations of Nivo

In addition to those arising from the law and the Service Order, Nivo undertakes to:

Provide the Service with the diligence and care of a professional technology provider.
Keep the Dashboard and the public pages available in accordance with section 18.
Deliver and configure the Tags and train the Contracting Business’s staff when so agreed.
Handle support requests through the channels in section 2 within a reasonable time.
Adopt the security measures described in section 40.
Process End Customers’ Personal Data solely as Processor and in accordance with the Contracting Business’s instructions contained in this document.
Inform the Contracting Business of security incidents affecting its data, under section 40.
Deliver its data to the Contracting Business upon termination, under section 16.

7. Obligations of the Contracting Business

The Contracting Business undertakes to:

Provide truthful, complete and up-to-date information, especially its Google listing identifier and its contact and billing details.
Pay the price in the manner and at the times agreed.
Safeguard the Dashboard credentials, the checkout scanner link and its access key. Any act performed with them is presumed to have been performed by the Contracting Business, which must immediately inform Nivo of any loss or unauthorized use.
Be liable for the acts of its Authorized Users and staff.
Comply with the Google, Apple and Meta policies applicable to its listing, passes and account.
Refrain from making any benefit, discount or reward conditional on posting a review or giving a particular rating.
Clearly define and deliver the rewards offered in its loyalty program, disclosing their conditions of time, manner and place in accordance with article 33 of Colombian Law 1480 of 2011.
Comply with its duties as Controller of its End Customers’ data, under Part II.
Send commercial communications only to End Customers who have authorized them, through the authorized channel and within the days, hours and frequency permitted by Colombian Law 2300 of 2023: Monday to Friday from 7:00 a.m. to 7:00 p.m. and Saturdays from 8:00 a.m. to 3:00 p.m., never on Sundays or public holidays.
Warrant that it owns or is licensed to use the trademarks, logos and images it provides for customizing the Service, and hold Nivo harmless from third-party claims in that regard.
Place the Tags in visible locations of its establishment, not alter them, and notify Nivo of any damage or loss.

8. Acceptable use and prohibited conduct

Any user of the Service is prohibited from:

Generating, buying or soliciting fake reviews, reviewing one’s own business, offering anything in exchange for reviews or ratings, or diverting dissatisfied customers to prevent them from posting their opinion.
Accessing or attempting to access, without authorization, accounts, data or systems of Nivo or of other Contracting Businesses.
Reverse engineering, decompiling or disassembling the software, except where expressly permitted by law.
Running vulnerability scans, load tests or penetration tests without Nivo’s prior written authorization.
Introducing malicious code, or uploading unlawful content or content that infringes third-party rights.
Using End Customers’ data for purposes other than those authorized, or assigning, selling or sharing it.
Reselling, sublicensing or making the Service available to third parties without Nivo’s written authorization.

Breach of this section entitles Nivo to immediately suspend access and terminate the contract, without prejudice to any civil and criminal actions available, including those under Colombian Law 1273 of 2009.

9. Google reviews and third-party platforms

Nivo merely facilitates the End Customer’s access to Google’s official review form. Nivo does not write, edit, filter, delete or publish reviews; the decision to post, the content and the rating depend exclusively on the End Customer.

Google, Apple and Meta are third parties independent of Nivo. Their policies, the availability of their services and their decisions, such as removing reviews, suspending listings or rejecting passes, are not attributable to Nivo.

Google does not identify review authors or report new reviews per day. Accordingly, the reviews attributed to the Service in the Dashboard are an estimate calculated from the daily change in the total published by Google and from the recorded taps, and do not constitute a certification.

The Contracting Business acknowledges that inducing reviews through incentives or presenting them in a way that does not reflect consumers’ real opinion may constitute misleading information or advertising under Colombian Law 1480 of 2011.

10. Loyalty program

The loyalty program, its rewards, rules and duration are defined by the Contracting Business. Nivo supplies only the technology tool. The obligation to deliver rewards rests exclusively with the Contracting Business vis-à-vis the End Customer.

Participation is free and voluntary for the End Customer and is not a requirement to purchase or to leave a review. Accumulated visits are not money, have no cash value, are non-transferable and may only be redeemed at the Contracting Business’s establishment.

Visits are recorded when the Contracting Business’s staff scans the Digital Pass. Recording errors may be corrected at the Contracting Business’s request.

The Digital Pass is stored in Google Wallet or Apple Wallet, whose terms govern its use. If the Contracting Business terminates the Service, the Digital Passes will be deactivated and the Contracting Business shall inform its End Customers and honor the rewards already earned under its own conditions.

11. Artificial intelligence features

Some features use third-party artificial intelligence models to generate draft replies to reviews, analyses of comments, draft messages for End Customers, Instagram recommendations, chat assistant answers, and the reading of statistics screenshots uploaded by the Contracting Business.

The results are suggestions. Nivo does not publish replies or send messages automatically; the Contracting Business reviews and adjusts them, decides whether to use them, and is responsible for the content it publishes or sends.

Only the following is sent to artificial intelligence providers: the public content of reviews (author’s visible name, rating and text), the Contracting Business’s information, aggregate statistics and text written by the Contracting Business itself. The names, emails and phone numbers of End Customers enrolled in the loyalty program are not sent: messages are generated with placeholders that are filled in on Nivo’s servers.

Generated results may contain inaccuracies and must not be taken as professional advice.

12. Nivo Social and Meta integration

The Instagram account is connected through Meta’s official authorization system and is limited to reading the professional account’s statistics. Nivo does not publish content, send direct messages, know the account password, or make an End Customer follow the account automatically.

Access tokens are stored encrypted. The Contracting Business may revoke the connection at any time from the Dashboard or from its Meta account settings. Changes introduced by Meta to its platform may limit features without liability for Nivo.

13. Trial period

Nivo may grant, by written agreement, a Trial Period for the term and under the conditions stated therein.

During the Trial Period the Service operates in pilot mode: End Customers’ emails and phone numbers are displayed masked and cannot be exported, in order to protect Data Subjects while no contract is in force.

If, upon expiry, the Contracting Business does not contract the Service, Nivo will deactivate the Tags and Digital Passes and delete the End Customer data collected within the following thirty (30) calendar days. If it does contract, Processing will continue under Part II.

14. Price, invoicing and payment

The price is that of the plan published at nivosaas.lat or stated in the Service Order, expressed in Colombian pesos. Published prices are the total amount payable by the Contracting Business: any applicable taxes are deemed included, unless the Service Order expressly itemizes them before contracting.

Payments shall be made on the dates and by the means indicated in the Service Order. Nivo will issue the supporting documents required by current tax regulations.

Amounts paid for installation, Tags, design and training are non-refundable once performed, except in the event of a duly proven breach by Nivo.

Late payment accrues default interest at the maximum legal rate, under article 884 of the Colombian Commercial Code. After fifteen (15) calendar days of default, and with five (5) business days’ prior notice, Nivo may suspend the Service until payment, without the suspension extinguishing the obligation.

Nivo may adjust the price once a year, with thirty (30) calendar days’ notice. If the Contracting Business does not accept it, it may terminate the contract without penalty before the adjustment date.

15. Term, renewal and termination

The contract begins upon activation of the Service and has no minimum term. The first month of Service is included in the setup payment. From the second month the contract continues for monthly periods with the Services the Contracting Business chooses to keep, and renews automatically each month until either Party terminates it. If the Contracting Business pays in advance for a longer period, the term shall be the period paid for.

The Contracting Business may terminate the contract at any time, without penalty, by written notice; termination takes effect at the end of the period already paid for. Termination does not entitle it to a refund of the amounts described in section 14 or of periods paid in advance, and leaves the Contracting Business liable for the sums accrued up to the effective termination date.

Nivo may terminate the contract: (i) if the Contracting Business breaches its obligations and fails to cure the breach within ten (10) business days after being notified; or (ii) immediately, in the event of conduct prohibited by section 8, fraud, risk to the security of the platform or of Data Subjects, or an order from a competent authority.

Upon termination, Dashboard access ceases, the Tags and Digital Passes are deactivated, and section 16 applies.

16. Return and deletion of data upon termination

Within thirty (30) calendar days after termination, the Contracting Business may request an export of its End Customer list and its metrics in a structured, commonly used format.

After that period, Nivo will delete the Personal Data of End Customers and of the Contracting Business, except data it must keep to comply with legal, accounting or tax obligations, for the period those obligations require. Nivo may keep anonymized statistical information that does not allow any person to be identified.

17. Intellectual property

The software, source code, databases, designs, texts and the Nivo brand are owned by Nivo or its licensors and are protected by Andean Decision 351 of 1993, Colombian Law 23 of 1982, Andean Decision 486 of 2000 and other applicable rules. The contract grants the Contracting Business a limited, non-exclusive, non-transferable and revocable license of use, during its term and for the purposes of the Service. No right is transferred beyond what is provided herein.

The Contracting Business retains ownership of its trademarks, logos and the data it generates in the Service, and grants Nivo a free, non-exclusive license to use them solely to provide the Service. Nivo may only mention the Contracting Business as a client or display its logo in commercial materials with its express authorization.

The Tags and printed material delivered become the property of the Contracting Business once paid for; their operation depends on the Service being in force.

Suggestions made by the Contracting Business about the Service may be freely implemented by Nivo without any consideration.

18. Availability, maintenance and support

Nivo will make reasonable efforts to keep the Service continuously available, without guaranteeing that it will operate without interruptions or errors. There may be scheduled maintenance, preferably during low-activity hours, as well as interruptions caused by infrastructure providers, telecommunications networks or the NFC compatibility of the End Customer’s device. For the latter case, each Tag includes a backup QR code.

The Service is provided under the conditions described in this document and in the Service Order, without warranties other than those expressly agreed and without prejudice to any mandatory legal warranties.

19. Limitation of liability

To the maximum extent permitted by law, Nivo’s total liability to the Contracting Business for any claim arising from the contract shall not exceed the amount actually paid by it during the six (6) months preceding the event giving rise to the claim.

Nivo shall not be liable for loss of profits, loss of customers, reputational damage or indirect or consequential damages, nor for: (i) decisions of Google, Apple, Meta or other third parties; (ii) the content of reviews posted by End Customers; (iii) the acts of the Contracting Business’s staff or Authorized Users; (iv) loss or disclosure of credentials attributable to the Contracting Business; or (v) failure to deliver rewards offered by the Contracting Business.

The limitations in this section shall not apply in cases of willful misconduct or gross negligence, under article 1522 of the Colombian Civil Code. If the Contracting Business qualifies as a consumer under Law 1480 of 2011, these limitations shall apply only insofar as they do not contravene mandatory provisions of that law.

20. Indemnity

The Contracting Business shall hold Nivo harmless from any claim, penalty, loss or reasonable expense, including attorneys’ fees, arising from: (i) misuse of the Service by the Contracting Business, its staff or its Authorized Users; (ii) breach of these Terms or of its duties as Controller; or (iii) infringement of third-party rights by the information, trademarks or materials it provides.

21. Confidentiality

Each Party shall keep confidential the non-public information of the other to which it has access in connection with the contract, including credentials, business data, financial terms and End Customer data, and shall use it only to perform the contract. This obligation does not extend to information that becomes public through no fault of the receiving Party, or that must be disclosed by order of a competent authority, in which case the other Party will be informed beforehand where the law allows. This obligation survives for three (3) years after termination of the contract and, with respect to Personal Data, indefinitely.

22. Force majeure and fortuitous events

Neither Party shall be liable for non-performance caused by force majeure or fortuitous events under article 64 of the Colombian Civil Code, including widespread failures of infrastructure providers, unilateral changes to the interfaces of Google, Apple or Meta, cyberattacks occurring despite the adoption of reasonable measures, and acts of authority. The affected Party shall inform the other as soon as possible.

23. Amendments

Nivo may amend these Terms. The new version will be published at nivosaas.lat/terminos with its date and version number and will be communicated to Contracting Businesses by email fifteen (15) calendar days before it takes effect. If the Contracting Business disagrees, it may terminate the contract without penalty before that date; otherwise, the new version shall be deemed accepted.

Substantial changes to Part II will be communicated to Data Subjects before implementation and, when they involve new purposes, a new Authorization will be requested.

24. Assignment

The Contracting Business may not assign the contract without Nivo’s prior written authorization. Nivo may assign it to a third party that takes over the provision of the Service, particularly in the event of a merger, spin-off, acquisition or sale of assets, by notice to the Contracting Business, which may terminate the contract without penalty within thirty (30) days after the notice.

25. Relationship between the Parties

The Parties act as independent contractors, with full technical, administrative and financial autonomy. The contract does not create any partnership, agency, representation or employment relationship. Each Party is responsible for the labor and social security obligations of its own staff.

26. Notices

Notices shall be sent to the email address registered in the Service Order and, in the case of Nivo, to admin@nivosaas.lat. They shall be deemed received in accordance with the rules of Colombian Law 527 of 1999. The Parties may also agree to use WhatsApp for operational communications.

27. Governing law and dispute resolution

This document and the contract are governed by the laws of the Republic of Colombia.

Disputes shall first be submitted to direct negotiation for thirty (30) calendar days from written notice of the dispute. If no agreement is reached, the Parties may resort to a legally authorized conciliation center and, failing that, to the competent courts of the Republic of Colombia.

The foregoing does not limit the powers of the Colombian Superintendency of Industry and Commerce (SIC) in consumer protection and personal data protection matters, nor the rights the law grants Data Subjects on a mandatory basis.

28. Final provisions

If any provision is found null or unenforceable, the others shall remain fully valid. Failure to exercise a right does not imply a waiver of it. Section headings are included for ease of reading and do not affect interpretation. Electronic copies of this document and of the Service Order have the same value as the original.

This document is published in several languages for ease of understanding. In case of discrepancy, the Spanish version prevails.

29. Part II. Personal Data Processing Policy: legal framework and principles

This Policy implements the fundamental right of habeas data enshrined in article 15 of the Colombian Political Constitution and is governed by Statutory Law 1581 of 2012, Decree 1074 of 2015 and Title V of the Single Circular of the Superintendency of Industry and Commerce.

In all Processing, Nivo applies the principles of legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security and confidentiality set out in article 4 of Law 1581 of 2012.

30. Capacity in which Nivo acts

As Controller, with respect to the data of Contracting Businesses, their representatives and Authorized Users, of persons who contact Nivo, and of the technical and security logs of visits to its pages.
As Processor, with respect to the data of End Customers enrolled in the loyalty program, the public reviews processed for the Contracting Business, and Nivo Social statistics. In these cases, the Controller is the Contracting Business.

For the purposes of article 25 of Decree 1377 of 2013 (article 2.2.2.25.5.2 of Decree 1074 of 2015), this section and sections 31 to 41 constitute the data transmission agreement between the Contracting Business and Nivo. Under it, Nivo undertakes to: (i) process the data solely for the purposes authorized by the Data Subjects and in accordance with the Contracting Business’s instructions; (ii) not use it for its own purposes or assign it to third parties; (iii) keep it confidential; (iv) apply the security measures of section 40; (v) engage only the providers of section 35, under equivalent obligations; (vi) assist the Contracting Business in handling inquiries and claims; (vii) report security incidents; and (viii) return or delete the data upon termination of the contract.

31. Personal Data processed

Contracting Businesses and Authorized Users: name or corporate name, identification number when stated in the Service Order, username, password (stored only as an irreversible cryptographic hash), contact email and phone, brand elements and session records.
End Customers of the loyalty program: name, email, mobile number, Digital Pass identifier, visits, rewards and redemptions with their dates, proof of Authorization (date, time, version of this Policy and IP address) and preference regarding promotional communications. If the Digital Pass is saved in Apple Wallet, also the device identifier and the notification token generated by Apple.
Authors of Google reviews: public name, public profile picture, rating, text and date of the review, obtained through Google’s official interface.
People who use the Tags or visit the website: no personal data is collected on the redirect pages; the date, time and source of the tap are recorded. The IP address is used transiently, for a maximum of two (2) minutes, to discard duplicate records and control abuse. If an attack attempt is detected, the IP address, requested path and user agent are recorded.
Nivo Social: aggregate audience statistics (age ranges, gender, country, activity hours), follower count, screenshots uploaded by the Contracting Business and conversations with the assistant.

Nivo does not request sensitive data under article 5 of Law 1581 of 2012, biometric data, or the location of End Customers.

The loyalty program is intended for adults. Data of children and adolescents may only be processed with the authorization of their legal representative and respecting their best interests, under article 7 of Law 1581 of 2012. If Nivo or the Contracting Business detects an enrollment that does not meet this requirement, the data will be deleted.

32. Purposes of Processing

With respect to Contracting Businesses and Authorized Users:

Entering into, performing, invoicing and collecting under the contract.
Creating and managing the account, authenticating users and providing support.
Sending communications about the Service, its changes, incidents and reports.
Preventing fraud, protecting platform security and responding to requests from authorities.
Producing aggregate internal statistics.
Informing about new Nivo services, a purpose the Data Subject may object to at any time.

With respect to End Customers, the purposes are exclusively those of section 33. With respect to review authors: showing the reviews to the Contracting Business, preparing draft replies and producing reports. With respect to technical logs: preventing and handling security incidents.

33. Processing of End Customers’ data

This section constitutes the privacy notice of the loyalty program and is made available to the End Customer before enrollment through the link included in the form.

Controller: the Contracting Business whose name appears on the enrollment form and on the Digital Pass.
Processor: Nivo, identified in section 2, with service channel admin@nivosaas.lat.
Purposes: (i) enrolling and identifying the End Customer in the program; (ii) issuing and updating their Digital Pass; (iii) recording visits, rewards and redemptions; (iv) handling their requests; (v) producing aggregate program metrics for the Contracting Business; and (vi) only if the End Customer ticked the optional box, sending them promotions and reward notices by WhatsApp or email.
Voluntary nature: providing the data is voluntary. Declining to enroll does not prevent purchasing at the establishment or leaving a review.
Authorization: it is prior, express and informed, and is given by ticking the box on the form. Without it, no enrollment is created. The date, time, version of this Policy and IP address are kept as proof.
Promotional communications: they require an additional, independent and optional Authorization, whose refusal does not prevent participation in the program. They are sent by the Contracting Business through its own channel, within the hours of Law 2300 of 2023 indicated in section 7. Nivo only prepares drafts and never sends messages automatically. The End Customer may withdraw this Authorization at any time by replying to the message or writing to the service channel.
Location: the Digital Pass may include the establishment’s address so the phone shows a notice when the End Customer is nearby. That comparison is performed by the device itself: Nivo and the Contracting Business do not receive, query or store the End Customer’s location. The feature can be turned off in the phone or wallet settings.
Circulation: the Contracting Business accesses the data of its own End Customers from the Dashboard. Nivo does not sell, rent or assign this data.
Retention: the data is kept while the End Customer remains enrolled and the Contracting Business keeps the Service, and is deleted under sections 16 and 41 or earlier, at the Data Subject’s request.
Rights: those of section 37, exercised under section 38.

34. Cookies and local storage

The website uses a first-party cookie to remember the chosen language, lasting one (1) year. The Dashboard uses the browser’s local storage to keep the session, which expires after twenty-four (24) hours, and the theme preference. The Nivo Social panel uses protected session cookies and an anti-request-forgery token.

All of them are strictly necessary for the Service to work. Nivo does not use third-party advertising or analytics cookies. Fonts are loaded from Google Fonts servers, which involves transmitting the visitor’s IP address to Google.

35. Technology providers

To provide the Service, Nivo relies on the following providers, which act as its processors or as third-party platforms, as the case may be:

Supabase, Inc.: database (United States).
Render Services, Inc.: server hosting and cache (United States).
Vercel Inc.: Dashboard hosting.
Google LLC: Google Wallet, Google Maps and Places, corporate email and fonts.
Apple Inc.: Apple Wallet and notification service.
Meta Platforms, Inc.: only when the Contracting Business connects its Instagram account.
OpenRouter, Inc. and the model providers it routes to, Groq, Inc. and Google LLC (Gemini): content generation with artificial intelligence, within the scope of section 11.
GitHub, Inc.: execution of scheduled tasks on the Contracting Business’s data.
The network and perimeter security providers of the hosting provider.

36. International transfers and transmissions

The database and application servers are located in the United States of America, a country declared to have an adequate level of data protection by the Superintendency of Industry and Commerce through External Circular 005 of 2017, which added numeral 3.2 to Title V of the Single Circular.

Disclosure of data to the providers in section 35 constitutes a transmission to processors, covered by contracts that impose security and confidentiality obligations on them. Only the information described in section 11 is sent to artificial intelligence providers. Nivo does not sell or transfer data to third parties for their own purposes.

37. Rights of Data Subjects

Under article 8 of Law 1581 of 2012, the Data Subject has the right to:

Know, update and rectify their Personal Data, including partial, inaccurate, incomplete, fragmented or misleading data.
Request proof of the Authorization granted.
Be informed, upon request, of the use made of their data.
File complaints with the Superintendency of Industry and Commerce, once the procedure in section 38 has been exhausted.
Revoke the Authorization and request deletion of their data when there is no legal or contractual duty to keep it.
Access their data free of charge, at least once every calendar month and whenever there are substantial changes to this Policy.

38. Procedure for inquiries and claims

The rights may be exercised by the Data Subject, their successors, their representative or attorney, and whoever acts under a stipulation in favor of another, upon proof of their standing.

Requests are submitted to admin@nivosaas.lat stating: name and identification of the Data Subject, the business where they enrolled when applicable, description of the facts and of the request, a reply address and any supporting documents. Nivo may verify the requester’s identity before replying.

The Contracting Business instructs Nivo to receive and process End Customers’ requests on its behalf, and Nivo will inform it of those it receives.

Inquiries: answered within a maximum of ten (10) business days from receipt. If this is not possible, the reasons and the reply date will be communicated, which shall not exceed five (5) additional business days.
Claims: answered within a maximum of fifteen (15) business days from the day after receipt, extendable by up to eight (8) business days after communicating the reasons. If a claim is incomplete, the claimant will be asked to complete it within five (5) days; after two (2) months without a response, it will be deemed withdrawn. Within two (2) business days after receiving a complete claim, the legend “claim in progress” will be added to the database and kept until the claim is decided.

Before resorting to the Superintendency of Industry and Commerce, the Data Subject must exhaust this procedure, under article 16 of Law 1581 of 2012.

39. Authorization and revocation

Except in the cases of article 10 of Law 1581 of 2012, all Processing requires the prior, express and informed Authorization of the Data Subject, obtained by a means that allows later verification.

The Data Subject may revoke the Authorization or request deletion of their data at any time through the channel in section 38. Revocation is not available when there is a legal or contractual duty to remain in the database. Revoking the Authorization for promotional communications does not affect participation in the loyalty program.

40. Information security

Nivo adopts reasonable technical, human and administrative measures to protect the data against tampering, loss, consultation, use or unauthorized or fraudulent access, including: encryption of communications, storage of passwords through irreversible hash functions, encryption of third-party tokens, isolation of each Contracting Business’s information, restriction of direct database access, multi-factor authentication on administration consoles, request rate limiting, automatic blocking of addresses showing attack patterns, security event logging and periodic review of dependencies.

In the event of a security incident affecting Personal Data, Nivo will inform the Contracting Business without undue delay and no later than seventy-two (72) hours after its confirmation; will report it to the Superintendency of Industry and Commerce within fifteen (15) business days after its detection, under Title V of the Single Circular, when applicable; and will notify affected Data Subjects when appropriate.

41. Retention and deletion

Data is kept for as long as necessary to fulfill the purposes informed. In particular: Contracting Business data, for the term of the contract and the additional period required by commercial and tax rules on document retention; End Customer data, under section 33; security logs, for the time needed to investigate and prevent incidents; and public reviews, while the Contracting Business keeps Nivo Reviews.

Deletion is carried out by removing the records from the active database. Backup copies managed by providers are deleted according to their rotation cycles.

42. Department responsible for handling requests

Nivo’s data protection department handles Data Subjects’ requests, inquiries and claims at admin@nivosaas.lat and on WhatsApp +57 304 452 9157.

43. National Database Registry

Nivo will register its databases in the National Database Registry (RNBD) when required to do so under Decree 1074 of 2015 and the instructions of the Superintendency of Industry and Commerce. With respect to End Customer databases, the registration obligation, where applicable, lies with the Contracting Business as Controller.

44. Data Subjects located outside Colombia

Nivo recognizes the same rights to Data Subjects located outside Colombia. Where the legislation of their country, such as the European Union’s General Data Protection Regulation, grants them additional rights, such as portability, restriction of Processing or objection, they may exercise them through the channel in section 38, and Nivo will handle them to the extent that such legislation applies.

45. Effective date of the Policy

This Policy, version 2026-10-04, is effective as of October 4, 2026 and replaces previous versions. The databases will remain in force for as long as the purposes for which the data was collected subsist.

For any questions about this document: admin@nivosaas.lat or WhatsApp +57 304 452 9157.