Personal Data Processing Policy

1. Data controller

The controller of your personal data is Tu Mascota ID, a Colombian brand that operates the website tumascotaid.com(hereinafter, "Tu Mascota ID", "we" or "the platform").

When a veterinary clinic records its clients' data on the platform or connects its own WhatsApp number, the clinic is the controller of that data and Tu Mascota ID acts as processor on the clinic's behalf (see section 12 and the Terms for clinics).

Official channels for data subjects:

• Email: hello@tumascotaid.com
• WhatsApp: +57 312 880 1380
• Website: tumascotaid.com

This email address is the official channel to file inquiries and claims about personal data, and to receive notices related to this policy.

2. Legal framework

This policy is governed by article 15 of the Political Constitution of Colombia, Law 1581 of 2012, Decree 1074 of 2015 (which compiled Decree 1377 of 2013) and the guidance of the Superintendence of Industry and Commerce (SIC), Colombia's data protection authority.

3. Definitions

• Data subject: the natural person whose personal data is processed.
• Personal data: any information linked or that may be associated with an identified or identifiable natural person.
• Sensitive data: data that affects the data subject's privacy or whose misuse may lead to discrimination (health, biometric data, racial origin, among others).
• Processing: any operation on personal data: collection, storage, use, circulation or deletion.
• Processor: whoever processes data on behalf of the controller (for example, our infrastructure providers).
• Authorization: the data subject's prior, express and informed consent to process their data.

4. Data we collect

4.1. From the pet owner (registered user)

• First and last name.
• Email address (also the login identifier for the account).
• Phone or WhatsApp number.
• City.
• Profile photo, bio and links to social media, if you choose to add them.
• Privacy and communication preferences.

4.2. From the pet

Name, species, breed, sex, date of birth, color, distinctive marks, photos, and the health information you record: allergies, medical conditions, behavior, diet, vaccinations, deworming, medical history and photos of the vaccination card.

A pet's data is not personal data in itself, but because it is associated with you it receives the same protection as the rest of your information.

4.3. From whoever scans a tag (visitor)

When someone scans the QR code on a tag, we record the event so the owner knows their pet was seen. From that scan we store:

• Date and time.
• Code of the scanned tag.
• Precise GPS location, only if the visitor expressly authorizes it in their browser prompt. We only request it when the pet is reported as lost.
• Approximate city and country, derived from the connection's IP address.
• Browser and device type (user agent), to tell real visits from automated crawlers.

4.4. Browsing data

We use strictly necessary cookies to keep you signed in. We do not use third-party advertising or profiling cookies.

5. Sensitive data and minors' data

We do not deliberately request sensitive data from data subjects. Please note that the photos you upload may constitute sensitive data, and that the health information you record relates to your pet, not to a person.

Answering any question about sensitive data is optional. You can use the platform without uploading photos of yourself.

The service is intended for people over 18. We do not knowingly collect data from minors. If you find that a minor has given us information, write to us and we will delete it.

6. Purposes of processing

We process your data only to:

1. Create and manage your account, and authenticate you through sign-in codes or links sent to your email.
2. Activate your tags and link them to your pet's profile.
3. Publicly display your pet's profile and your contact details to whoever scans the tag, which is the essential function of the product (see section 7).
4. Record scans and their approximate location, and show them to you in your account to help you recover your pet.
5. Notify you by email when the tag of a pet you reported as lost is scanned.
6. Send you transactional service emails: welcome, activation, confirmation of a lost or found report.
7. Handle your support requests, and manage the purchase, shipping and warranty of tags.
8. Allow the veterinary clinic you authorize to record visits and verified vaccinations on your pet's profile.
9. Send you via WhatsApp, on behalf of your veterinary clinic and only if you gave permission, reminders of appointments, vaccinations and check-ups and other service messages, and allow your clinic to chat with you on WhatsApp from its panel (see section 12).
10. Comply with legal, accounting and tax obligations.

We do not sell, rent or transfer your personal data to third parties for commercial or advertising purposes.

7. Public nature of the pet profile

By activating a tag you expressly authorize that disclosure. At any time, from your account, you can control what information appears, hide your owner profile and decide whether the call and WhatsApp buttons are shown.

8. Authorization and its revocation

We obtain your prior, express and informed authorization when you create your account and activate your first tag, through acceptance of this policy.

You may revoke your authorization or request deletion of your data by writing to hello@tumascotaid.com. Revocation means deactivating the public profiles associated with your tags, so they will no longer show information to whoever scans them. Deletion will not proceed where there is a legal or contractual duty to keep the data.

9. Your rights as a data subject

Under article 8 of Law 1581 of 2012, you have the right to:

• Know, update and correct your personal data.
• Request proof of the authorization you gave.
• Be informed about how we have used your data.
• File complaints with the Superintendence of Industry and Commerce for violations of the law.
• Revoke the authorization and request deletion of your data, where applicable.
• Access your personal data free of charge.

10. How to exercise your rights

Write to us at hello@tumascotaid.com stating your full name, the email you registered with, a clear description of your request and any documents you wish to rely on.

You may go to the SIC only after completing the inquiry or claim procedure with us.

11. Processors and international transfer

To operate the platform we rely on infrastructure providers that act as processors and store information on servers outside Colombia, mainly in the United States:

By accepting this policy you authorize such international transfer and transmission of data. We require our providers to meet security and confidentiality standards equivalent to those described here.

12. WhatsApp messages

We use the WhatsApp Business Platform (Cloud API), a service of Meta Platforms, Inc. and WhatsApp LLC ("Meta"), in two ways:

1. Tu Mascota ID's WhatsApp line. From our own number we send, on behalf of the veterinary clinics that use the platform, confirmations and reminders of appointments, vaccinations, check-ups and deworming, and other service messages. We only send them to people who gave permission to receive WhatsApp messages. We use the replies we receive on that line only to record the confirmation, rescheduling or cancellation of an appointment, notify the clinic, give you its contact details, handle your support request or stop messaging you if you ask.
2. A clinic's WhatsApp number connected to its panel.A clinic may connect its own WhatsApp Business number to its Tu Mascota ID panel to reply to its clients' messages from there. The connection is made through Meta's Embedded Signup: the clinic can move the number entirely to the Cloud API or keep using the WhatsApp Business app on its phone at the same time ("coexistence"), in which case messages are synchronized both ways. In this case the clinic is the controller of its conversations and Tu Mascota ID acts as processor, on the clinic's behalf and according to its instructions. To exercise your rights over those conversations you can contact the clinic or us; if you write to us, we will forward your request to the clinic and help it respond.

12.1. Data we process

• Phone number and WhatsApp profile name.
• The business-scoped user ID that WhatsApp assigns, when the phone number is not shared.
• The content of messages and the files sent (photos, audio, documents and others).
• Message date and time and delivery and read status (sent, delivered, read or failed).
• Only if the clinic authorizes it when connecting its number in coexistence mode: the contacts in its WhatsApp Business app and up to six (6) months of prior history of its one-to-one chats (not groups).

12.2. What we use it for

• Allowing the clinic to reply to its clients from its panel.
• Linking each conversation to the client and to their pet's record at the clinic.
• Sending reminders and service messages to people who gave permission.

12.3. Meta and international transfer

WhatsApp messages pass through Meta's infrastructure, which also processes them under its own terms and privacy policy: the WhatsApp Business Terms and the WhatsApp Privacy Policy. Meta processes this data on servers located, among other places, in the United States, which constitutes an international transfer under section 11.

12.4. How to stop receiving messages

You can stop receiving WhatsApp messages at any time: reply "BAJA" or "STOP", use the opt-out button included in our reminders, or turn off the WhatsApp permission in your account. If the message comes from a clinic's number, you can also ask the clinic directly, which must respect your decision.

12.5. Retention

We keep conversations while the clinic's account and its WhatsApp connection are active. If the clinic disconnects its number, we stop sending and receiving messages through it; conversations already stored are part of the clinic's data, and the clinic may ask us to delete them: we will do so within thirty (30) days, unless the law requires us to keep them. If the clinic ends its membership, the data handover and deletion rules of the Terms for clinicsapply. Messages that have already reached your phone or the clinic's WhatsApp Business app remain on those devices and are outside our control.

13. Data retention

We keep your data while your account is active and for as long as it is needed for the purposes described. Scan history is kept while the pet remains on the platform, as it is the evidence that helps you locate it. Once your account is closed, we delete or anonymize the information, except what we must keep due to legal, accounting or tax obligations.

14. How to request deletion of your data

To ask us to delete your personal data, including WhatsApp messages:

1. Email us at hello@tumascotaid.com with the subject "Eliminar mis datos"("Delete my data").
2. Include your name, the email you registered with and, for WhatsApp, the phone number you wrote to us from or on which you received the messages.
3. If you have an account, you can also edit or delete your pet's profile and turn off the WhatsApp permission from it.

We handle the request as a claim, within the time limits of section 10: maximum 15 business days, extendable by 8 more business days. We will confirm through the same channel once the deletion is done. We will not delete data that the law requires us to keep (for example, accounting or tax data). If the data is a clinic's responsibility, such as your pet's medical record or conversations with the clinic's WhatsApp number, we will forward your request to the clinic and help it handle it. Deletion from our systems does not erase messages that are already on your phone, on the clinic's devices or in Meta's systems, which are governed by WhatsApp's privacy policy.

15. Information security

We apply reasonable technical and administrative measures to protect your data: encryption in transit (HTTPS), session-based access control, database-level restrictions and ownership checks on every operation on your information. The access tokens that Meta issues when a clinic's WhatsApp number is connected are stored encrypted. No system is infallible; if an incident compromises your data, we will report it as required by law.

16. Effective date and changes

This policy is effective from its publication and remains in force while we operate the platform and keep the databases. We may modify it; if the change is substantial, we will inform you by email or through a visible notice on the site before it takes effect.

See also our Terms and Conditions and the Terms for veterinary clinics.