Personal Data Processing and Privacy Policy

GTC INGENIERIA S.A.S. (hereinafter, GTC) is responsible for the personal data provided by its clients, prospective clients, employees, contractors, suppliers, visitors and users of its digital channels (hereinafter, the Data Subjects). This policy sets out the purposes, measures and procedures that apply to GTC’s databases, as well as the means available to Data Subjects to access, update, correct and delete their data or revoke the authorization they have given.

Accepting proposals, entering into contracts, filling in forms, using the website www.gtcingenieria.com, entering GTC’s premises, using the GTC App mobile application and the express or unequivocal acceptance of this policy constitute the Data Subject’s authorization for the processing described herein. The processing of sensitive data also requires express authorization.

• Article 15 of the Political Constitution of Colombia: rights to privacy, good name and habeas data.
• Statutory Law 1581 of 2012, General Personal Data Protection Regime.
• Decree 1074 of 2015 (chapters 25 and 26 of title 2, part 2, book 2), which regulates data collection, processing policies and the National Database Registry.
• External Circular 02 of 2015 of the Superintendence of Industry and Commerce and Decree 1759 of 2016.
• Decree 1072 of 2015 (Occupational Health and Safety Management System, SG-SST), regarding occupational health and safety records.

Authorization

Prior, express and informed consent of the Data Subject to the processing of their data.

Inquiry

A request by the Data Subject, or by persons authorized by them or by law, to know the information about them held in GTC’s databases.

Claim

A request to correct, update or delete data, or to revoke the authorization in the cases provided for by law.

Data controller

The person who decides on the database and the processing. In this policy, GTC.

Data processor

A person who processes data on behalf of the Controller.

Sub-processor

A person who processes data on behalf of a Processor.

Data Subject

The natural person whose data is processed.

Processing

Any operation on personal data: collection, storage, use, circulation or deletion.

Database

An organized set of personal data, whether physical or digital.

Personal data

Information that directly or indirectly relates to a natural person and makes it possible to identify them.

Sensitive data

Information that affects the Data Subject’s privacy or whose misuse may lead to discrimination, such as information revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership of trade unions or social organizations, as well as data concerning health, sex life and biometric data (article 5 of Law 1581 of 2012).

International transfer

Sending data to a Controller located outside Colombia.

International transmission

Sending data to a Processor located outside Colombia, which processes the data on behalf of GTC under a transmission agreement (article 2.2.2.25.5.2 of Decree 1074 of 2015).

National transmission

Sending data to a Processor within Colombia.

Application or GTC App

GTC’s mobile application for Android and iOS described in section 7.

GAIA

GTC’s technology platform that receives and manages the information recorded in the Application.

Company name

GTC INGENIERIA S.A.S.

Tax ID (NIT)

830.146.140-1

Address

Cra 7 # 115-60 CC Santa Bárbara, Local A101-102, Aptdo Pos Aa 102028, Bogotá D.C., Colombia

Phone

+57 310 297 7777

General email

info@gtcingenieria.com

Personal data

Inquiries, claims and deletion requests: info@gtcingenieria.com, with the subject line “Datos personales”. This team also handles matters related to the Application.

GTC processes personal data for the following purposes, depending on its relationship with each Data Subject:

• Clients and prospects: preparing proposals, entering into and performing contracts, invoicing, handling requests and sending commercial information related to GTC’s services.
• Employees and candidates: recruitment processes, entering into and performing the employment contract, payroll, social security, well-being, shift scheduling, equipment assignment, employment certificates and compliance with legal obligations.
• Contractors and suppliers: onboarding, counterparty due diligence, contract performance, payments and verification of compliance with occupational health and safety requirements on projects.
• Occupational health and safety: managing the SG-SST: inspections, audits, health condition reports, incident investigations, delivery of personal protective equipment and the other records required by Decree 1072 of 2015.
• Visitors: access control and security of premises and projects.
• Legal obligations: responding to requests from authorities and retaining information for the periods required by law.

• Legality and purpose: data is collected for lawful, specific purposes disclosed to the Data Subject, and is not used for incompatible purposes.
• Freedom: processing is only carried out with the Data Subject’s authorization or by legal mandate.
• Necessity and proportionality: only data that is adequate, relevant and not excessive for the purpose is collected.
• Accuracy or quality: information must be truthful, complete, accurate, up to date and understandable. Inaccurate data is corrected when the Data Subject requests it.
• Transparency: the Data Subject may at any time obtain information about the existence of data concerning them.
• Restricted access and circulation: data is only accessible to the Data Subject, the persons they authorize and those empowered by law or court order. Personal data, except public information, is not made available on the Internet or in mass media unless access is technically controllable.
• Security: technical, human and administrative measures are applied to prevent tampering, loss, consultation, use or unauthorized or fraudulent access.
• Confidentiality: everyone involved in processing must keep it confidential, even after their relationship with GTC has ended.

These policies are mandatory for all members of GTC and for third parties that process data on GTC’s behalf as Processors or Sub-processors, even after their relationship has ended. Any breach may be reported in writing at GTC’s address or through the transparency line lineadetransparencia@gtcingenieria.com.

GTC App is GTC’s mobile application for employee self-service (contract, shift planning, assigned equipment, documents, requests and occupational health and safety forms) and for contractors and third parties to fill in the forms GTC assigns to them. Access is restricted to people with an account issued by GTC: the Application does not allow open sign-up.

The health condition self-report forms collect sensitive data. In accordance with articles 5 and 6 of Law 1581 of 2012:

• The Data Subject is not required to authorize the processing of their sensitive data or to answer questions about it, except where a regulation requires it within the framework of the SG-SST.
• It is processed exclusively for the prevention of occupational health and safety risks, and never to make discriminatory decisions.
• Access is restricted to GTC’s occupational health and safety staff and to those empowered by law.
• It is protected by the measures in section 10, including encryption on the phone and in transit.

The biometric data (face or fingerprint) used to unlock the Application never leaves the phone’s operating system and never reaches GTC.

GTC does not sell or assign personal data. It only shares it with Processors that process it on GTC’s behalf, under confidentiality and transmission agreements, and with authorities that legally require it.

By using the Application, the Data Subject authorizes these international transmissions of data to the United States, which are carried out with providers offering adequate levels of protection and under the terms of article 26 of Law 1581 of 2012 and Decree 1074 of 2015. The content of push notifications is limited to what is necessary for the notice and does not include health data.

GTC has security policies and procedures in place to ensure the confidentiality, integrity and availability of information. In the Application, in particular:

• Encryption in transit: all communication with GTC’s servers uses HTTPS (TLS). The Application does not allow unencrypted connections.
• Encryption on the phone: the local database is encrypted with AES-256 (SQLCipher) and photos, videos and signatures are stored encrypted with AES-256-GCM. Keys are stored in the operating system’s secure storage (iOS Keychain or Android Keystore).
• Optional biometric access, which locks the Application when it is reopened.
• Screenshot protection for the QR credential.
• Sessions that expire; when signing out, the forms, catalogs and permissions downloaded for that account are deleted from the phone.
• No diagnostic logs in the published version: the Application does not write personal data to system logs.

Important: the local encryption key is deleted when the Application is uninstalled. Anything not sent to GTC before uninstalling cannot be recovered.

• On the phone: information is kept until it is sent to GTC and the session is closed, until the user deletes it from Settings in the Application, or until the Application is uninstalled.
• In GTC’s systems: for the duration of the employment or contractual relationship and, after it ends, for the applicable legal periods. SG-SST records are kept for at least twenty (20) years from the end of the employment relationship, in accordance with article 2.2.4.6.13 of Decree 1072 of 2015.
• Account and data deletion: Application accounts are issued and managed by GTC. The Data Subject may at any time request the deletion of their account and their data through the channel in section 13. GTC will fulfil the request unless there is a legal or contractual duty to retain the data. In that case, it will inform the Data Subject which data is retained, why and for how long, and will keep it blocked for any other use.

In accordance with article 8 of Law 1581 of 2012, the Data Subject has the right to:

• Access, update and correct their personal data.
• Request proof of the authorization given, except where the law does not require it.
• Be informed, upon request, of how GTC has used their data.
• File complaints with the Superintendence of Industry and Commerce, after exhausting the inquiry or claim procedure with GTC.
• Revoke the authorization and request the deletion of their data when there is no legal or contractual duty to retain it.
• Access their personal data free of charge, at least once every calendar month and whenever this policy changes substantially.

These rights may be exercised by the Data Subject, upon proof of identity; by their successors, upon proof of that status; by their representative or attorney, upon proof of representation; and by anyone acting under a stipulation in favor of another.

Channel: email to info@gtcingenieria.com with the subject line “Datos personales”, or a written communication delivered at GTC’s address. The request must include the Data Subject’s name and ID number, a description of the request, the address or email for the response and any supporting documents.

• Request and keep a copy of the authorization given by the Data Subject.
• Inform the Data Subject clearly and sufficiently of the purpose of the collection and of their rights.
• Guarantee at all times the full and effective exercise of the right of habeas data.
• Keep information under security conditions that prevent its tampering, loss, consultation, use or unauthorized or fraudulent access.
• Process inquiries and claims under the terms of this policy.
• Report to the Superintendence of Industry and Commerce any breaches of security codes and risks in the management of Data Subjects’ information, and comply with its instructions and requirements.
• Register its databases in the National Database Registry, where applicable.

The website www.gtcingenieria.com uses cookies and similar tools that automatically collect information such as the URL visited, the browser, the pages viewed, the IP address, clicks, hyperlinks and searches. The Data Subject can disable cookies in their browser settings. The GTC App does not use tracking cookies.

The Application is intended exclusively for adults engaged with GTC as employees or contractors. GTC does not knowingly collect data from children or adolescents through it.

GTC may amend this policy. Substantial changes will be communicated to Data Subjects before they take effect, on this website and, when they affect processing in the Application, within the Application itself. When the change concerns the purpose of processing, GTC will request a new authorization.

GTC complies with the privacy notice requirement of article 2.2.2.25.3.2 of Decree 1074 of 2015, which can be consulted through the channel in section 13.

This policy is effective from September 23, 2026. The databases will remain in force for as long as the purposes of processing and the legal retention duties subsist.