Personal data processing policy

1. Data controller

• Company name: Gestación con Amor S.A.S.
• Tax ID (NIT): [NIT]
• Address: Calle 73 #14-33, Office 303, Bogotá D.C., Colombia
• Data protection email: Gestacionc@gmail.com
• Phone / WhatsApp: +57 300 876 5274

2. Legal framework

This policy is governed by Article 15 of the Colombian Political Constitution, Statutory Law 1581 of 2012, Decree 1074 of 2015 (which compiles Decree 1377 of 2013) and any rules that amend or complement them. When we process data of people residing in the European Union, we will also apply the requirements of the General Data Protection Regulation (GDPR) where applicable.

3. Definitions

• Data subject: the person the data refers to.
• Sensitive data: data that affects the data subject's privacy or whose misuse may lead to discrimination, such as health data, sex life or biometric data.
• Processing: any operation on personal data: collection, storage, use, circulation or deletion.
• Processor: whoever processes data on behalf of the controller, such as technology providers or partners.
• Authorization: the prior, express and informed consent of the data subject.

4. Data we process

Intended parents

Identification, contact details, nationality and residence, marital status, information about your family network, data needed for legal and immigration procedures, and the medical information that is essential for the program.

Surrogates and candidates

Identification, contact details, socioeconomic and family information, results of medical, psychological and social work assessments, obstetric history, health insurance and coverage details, and information about her support network gathered during home visits.

Website and social media visitors

Data you send us through forms, WhatsApp or email, and technical browsing data as described in our cookies section.

Follow-up platform

Weekly medical records, appointments, photos, videos, ultrasounds, audio recordings and messages uploaded to the private platform.

5. Sensitive and health data

Much of the information in our programs is sensitive. Therefore:

• We only process it with your express authorization, in which we inform you that you are not obliged to provide it.
• We use it only for the purposes of the program you joined.
• Access is limited to staff and partners who need it to perform their role, under confidentiality obligations.
• We apply reinforced security measures, such as role-based access and activity logs on the platform.

6. Data of children and adolescents

We process data of the baby and, where applicable, of the surrogates' children (for example, for vouchers or gifts), always respecting the best interests of the child and with the authorization of their legal representative. We never publish data or images of minors without that express authorization.

7. Purposes

• Answering questions and requests, and scheduling the first appointment.
• Evaluating, selecting and supporting surrogates and intended parents.
• Coordinating services with partner clinics, health professionals, lawyers, insurers, hotels and transport providers.
• Managing health coverage, insurance and program benefits.
• Operating the pregnancy follow-up platform.
• Managing payments, expenses and accounting and tax obligations.
• Complying with legal obligations and responding to requests from authorities.
• Sending program information and, only if you authorize it separately, marketing communications.
• Using testimonials, photos or videos only with a separate, specific authorization.

8. Rights of the data subject

As a data subject you may, free of charge:

• Access, update and correct your data.
• Request proof of the authorization you gave us.
• Be informed about how we use your data.
• Revoke your authorization or request deletion of your data, except where there is a legal or contractual duty to keep it.
• File complaints with the Colombian Superintendence of Industry and Commerce (SIC), after completing the process with us.

9. How to exercise your rights

Write to Gestacionc@gmail.com with your name, ID document, the specific request and a way to reply to you.

• Inquiries: we reply within 10 business days at most, extendable by 5 business days with prior notice.
• Claims (correction, update, deletion or non-compliance): we reply within 15 business days at most, extendable by 8 business days with prior notice.

10. Data transfer and transmission

To carry out the program, we may share data with partners in Colombia and in other countries, such as lawyers in Spain or in the parents' country of residence. We do so only for the authorized purposes, with confidentiality agreements and, when the destination country does not offer an adequate level of protection, with your express authorization or under the exceptions provided by law. Our technology providers may store information on servers outside Colombia, with appropriate security measures.

11. Security

We apply reasonable technical, human and administrative measures to protect data against loss, unauthorized access or misuse: role-based access, passwords, encryption in transit and team training. No system is infallible; if an incident affects your data, we will inform you and report it to the authority when required.

12. Retention

We keep data for the duration of our relationship with the data subject and for any additional time required by accounting, tax or health regulations or by legal limitation periods. After that we delete or anonymize it.

13. Cookies and similar technologies

The website may use its own and third-party cookies to work, to measure visits and, if you accept, for advertising purposes. You can accept, reject or configure them in the cookie notice and in your browser. Strictly necessary cookies do not require consent.

14. Data subjects in the European Union

If you reside in the European Union, in addition to the rights above you may request restriction of processing, object to it and request data portability, and you may contact the data protection authority of your country. The legal basis for processing your health data is your explicit consent.

15. Changes to this policy

We may update this policy. We will publish the new version with its date and, if the change affects the purposes, we will ask for your authorization again.

Base document pending review by the legal advisor of Gestación con Amor S.A.S. English translation for reference; the Spanish version prevails.