Privacy policy and personal data processing

This Personal Data Processing and Privacy Policy (the “Policy”) explains how Harvis by Tecde (“Harvis,” “Tecde,” “we”) collects, uses, stores, shares and protects personal data when our websites, dashboards, applications, WhatsApp, SMS and other authorized channels are used.

The terms governing access to and use of the Service—including account rules, payments, acceptable use and artificial intelligence—are published separately in the Terms and Conditions of Use. This Policy does not replace specific consents we may request for a given purpose.

Harvis by Tecde complies with Colombian personal-data-protection law—Statutory Law 1581 of 2012, Decree 1377 of 2013, Law 1266 of 2008 and rules that regulate, amend or replace them—as well as Law 1480 of 2011 (Consumer Statute) and, where applicable due to the user’s location, international rules such as the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Harvis by Tecde is provided by two entities according to the user’s territory. TECDE COLOMBIA S.A.S. — NIT 901.993.409-7 — is domiciled at Cra. 83AA # 9-31, Medellín, Antioquia, Colombia. TECDE INC. — EIN 61-2164854 — is domiciled at 838 Walker Rd., Suite 20-1, Dover, Delaware, United States. Both use info@tecde.co, and Juan Sebastián Ochoa is the person responsible for data processing.

Both entities (jointly or individually, “Tecde”) act as controllers according to the user’s location and share guidelines protecting information. The Colombia office serves Latin American users; the Delaware office administers activities with international impact. When a user accesses from outside Colombia, data may be processed and transferred to the United States, Colombia or other countries where Tecde operates, complying with international-transfer requirements under applicable law and rules such as the GDPR.

TECDE COLOMBIA S.A.S. registers and keeps its databases current with the Superintendence of Industry and Commerce (SIC) where required by current regulation.

Harvis often operates under a model in which an anchor organization—agribusiness, cooperative, federation, marketer, parent company or other entity—purchases the Service and enables access for producers or other affiliated users (the “Contracting Entity” and “Affiliated Producers”).

Depending on the Service configuration, Tecde and/or the Contracting Entity are controllers where they decide the purposes and processing of data within their authorized group. Tecde is processor when it processes data on the Contracting Entity’s behalf and instructions, in which case the corresponding data-transmission agreement is entered into. The data subject is the Affiliated Producer or natural-person user to whom the data relates and always keeps legal rights.

In white-label deployments, the Contracting Entity acts as controller toward its Producers and Tecde as processor under the commercial contract and data processing agreement (DPA). By using Harvis through a Contracting Entity, the Affiliated Producer gives prior, express, free and informed authorization for Tecde to process and share—or make accessible to—the Contracting Entity and companies in its authorized group the personal, agronomic and operational data generated or provided in that context.

Purposes include agronomic assistance; technical and productive monitoring; reports and findings, including white-label reports; group indicators; and improved support. Sharing is limited to the authorized group and does not grant indiscriminate third-party access. The authorization does not affect the Producer’s status as data subject or rights; requests concerning business data shared in an organization workspace may be coordinated with Contracting Entity administrators and through info@tecde.co.

The Contracting Entity defines its workspace governance: who accesses it and with what role, what operational data is retained or exported, and collective account decisions. Harvis is designed to restrict each organization’s operational information and content to its own database, dashboard and cloud-storage context; where a parent company and affiliated producers or businesses are involved, it may permit data viewing within that authorized group according to the Service configuration. Organization-level deletion may broadly remove that customer’s data, subject to legal retention periods and temporary backups.

Technical separation between companies does not replace strong passwords, second-factor authentication where available, or orderly credential management. A person accessing with a valid account is treated as an authorized user within their role’s scope.

For personal-data processing, Harvis by Tecde follows the principles of lawfulness, purpose limitation, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality established in Law 1581 of 2012.

Before collecting personal data, Harvis by Tecde tells users about the purposes and requests their express, free and informed consent. Consent is obtained electronically when interaction begins and remains valid until revoked. Where processing relies on the authorization in Section 3.2, it is understood to be granted by using the Service through the Contracting Entity.

• Agricultural-assistant service delivery: manage technical and administrative queries, generate answers and reports on crops and agronomic matters, and keep an interaction history to improve the Service.

• Administrative and commercial management: keep user and interaction records for billing, accounting, internal control and management of free and paid plans.

• Support within the authorized group: allow the Contracting Entity to monitor Affiliated Producers and produce reports and aggregate indicators under Section 3.

• Product improvement and statistical analysis: analyze usage information in pseudonymized and aggregated form to optimize solutions, develop features and ensure stable, secure operation without identifying specific data subjects.

• Legal compliance: respond to competent-authority requests and data-protection, security and transparency obligations.

• Categories: basic identification (the name or public alias used on WhatsApp); contact data (telephone number linked to the WhatsApp account); user content (messages, crop images, voice notes, agronomic results and other voluntarily shared data); agronomic and operational data (farms, plots, crops, work and results); usage data (access logs, dates, times, IP address, session identifiers, device, browser and usage statistics); and website data (cookie preferences, pages viewed, referral source, and analytics or advertising events only when authorized). Harvis by Tecde does not knowingly collect sensitive data or children’s data; if collected by mistake or misuse, they will be deleted immediately.

When someone starts a conversation, registers, or asks to receive communications through WhatsApp or SMS, we process the telephone number, channel identifier, date and evidence of consent, message history and information shared. This is used to handle the conversation, provide the Service, send requested operational communications and, only where applicable authorization exists, marketing communications.

Users may stop receiving promotional messages at any time through the opt-out mechanism disclosed in the message, by replying STOP where available for SMS, or by writing to info@tecde.co. Opting out of promotional messages does not prevent transactional or security messages needed to provide the Service where law permits.

Mobile telephone-number information and SMS consent will not be shared, sold or transferred to third parties or affiliates for marketing or promotional purposes. We may use providers such as Meta/WhatsApp Business Platform and messaging providers solely to deliver the channel, manage messages, prevent fraud, provide support or meet legal obligations; they receive no authorization to sell, use or disclose that data for their own marketing purposes.

WhatsApp and SMS are third-party services subject to their own policies and conditions. We do not control their networks, deliverability, availability or independent data processing. We recommend not sending sensitive information, passwords, complete financial data or children’s information through these channels.

The legal bases are data-subject consent; performance of a contract with the user or Contracting Entity; legitimate interest in improving processes, assessing service quality and preventing fraud or abuse while balancing data-subject rights; and compliance with a legal obligation.

Data is used only for this Policy’s purposes. It may be shared with technology providers such as Meta/WhatsApp Business Platform, AWS and Supabase, which are bound to confidentiality and security; with the Contracting Entity and its authorized group under Section 3; with competent authorities when the law requires; and with strategic partners only where a data-transmission agreement exists and the user has expressly authorized transfer or use for specific purposes.

We never sell or transfer personal data for advertising, including mobile-number information and SMS consent. We do not use automated profiling to make decisions producing legal effects or significantly affecting a user without human intervention.

Harvis by Tecde uses providers located in several countries—including Meta/WhatsApp Business Platform, AWS and Supabase—so some data may be transferred internationally. We ensure security and privacy standards equivalent to Law 1581 of 2012, GDPR and CCPA through data-transmission agreements, data-protection clauses, European Commission standard contractual clauses and similar mechanisms.

Under Colombian law and, where applicable, the GDPR, data subjects have rights of access, rectification, cancellation and erasure where no legal or contractual duty prevents it; objection to unauthorized purposes; portability where applicable; withdrawal of consent; and complaint to the SIC in Colombia or the competent supervisory authority.

If a user belongs to Harvis through a Contracting Entity, or that organization pays for the Service, these rights remain theirs. However, requests about business data shared in the organizational workspace may be handled first or in parallel with the designated administrators, under applicable law and agreements.

To exercise rights, email info@tecde.co with the right to be exercised, the data concerned and supporting documents. Tecde may request additional information to verify identity. After receiving a complete request, we will respond within a maximum of fifteen (15) business days; for erasure requests, we will delete or anonymize data unless a legal obligation prevents it.

When users access the Harvis by Tecde web platform, we use cookies or similar technologies to remember the session and keep authentication active; analyze browsing and use to improve experience and performance; store preferences; and configure website functionality.

Strictly necessary cookies enable essential functions such as security, authentication and fraud prevention. Analytics and advertising cookies—including Google and Meta services measured to understand campaigns and conversions—are activated only after user acceptance from the cookie notice. Users may choose “Necessary only,” accept all, or later change their decision from the website’s “Cookies” button.

Users may also delete or block cookies from their browser. Disabling necessary cookies may affect login, preferences or platform operation. Cookies are not used to collect WhatsApp or SMS conversation content for advertising.

Harvis by Tecde implements reasonable technical, human and administrative measures to protect personal data and prevent loss, unauthorized access, misuse or disclosure: encryption in transit and at rest, restricted database access, continuous infrastructure monitoring and staff training in privacy and data protection.

Data is kept only for the time necessary to fulfill this Policy’s purposes or legal, contractual or accounting obligations. Once purposes are fulfilled or the period expires, data is securely deleted or anonymized.

If a security incident may compromise personal data, we will assess its scope and take containment and remediation measures. Where the law requires, we will notify data subjects and competent authorities within applicable time periods.

This Policy is effective upon publication through official channels and remains effective until amended or updated. Harvis by Tecde may update it to reflect regulatory, Service or operational changes; updates will be published through official channels and take effect upon publication. Users are encouraged to review it periodically.

For privacy inquiries, to exercise rights or to submit a complaint, contact info@tecde.co. For unresolved matters, data subjects may contact the SIC or another competent authority according to their jurisdiction.