Privacy Policy

Privacy summary for girls and boys

If you are a child, this application must be set up and managed by your mom, dad, guardian, or another responsible adult. We only store the information needed to show you educational activities and to remember which ones have been presented. We do not want you to share private data on your own.

1. Who we are and scope of this Policy

Bits de Inteligencia is a subscription-based digital service aimed at families and tutors for organizing and presenting educational content known as “bits de inteligencia” to learners, including children up to eight (8) years old. The contractual account must be created and administered by an adult with the capacity to act on behalf of the minor.

For the purposes of this Policy, Carlos Mario Toro Franco — Bits de Inteligencia, with its registered address at Calle 102 # 43-35, Barranquilla, Colombia, is the “Controller” of the personal data processed through the Service, unless a feature or contractual relationship expressly indicates another legal role.

This Policy applies to the website, the application, subscription accounts, support functions, and the other interactions in which it is referenced. Where a local rule grants a person greater protection, we will apply that protection to the extent such rule is applicable to the processing.

2. Principles governing our processing

We design data processing under the principles of lawfulness, fairness, and transparency; specific purpose; minimization; accuracy; limited storage; security; confidentiality; demonstrated accountability; privacy by design and by default; and, when children are involved, the prevalence of their best interests and their fundamental rights.

Children's data receive a reinforced level of protection. Business decisions do not prevail over the best interests of the minor when the two conflict.

3. Who may create an account and how we handle minors' data

The subscription account and privacy decisions must be managed by a responsible adult. The Service is not designed for a child to enter into the subscription contract alone or to authorize by themselves processing that, under applicable law, requires parental authorization.

When processing of the minor's data is based on consent or parental authorization, we will use reasonable measures proportionate to the risk to verify that the authorization comes from the father, mother, guardian, or holder of parental responsibility. In countries where the law requires verifiable parental consent before collecting a minor's data — for example, under COPPA in the United States for children under 13 — we will not start that processing until the required authorization is obtained, unless an applicable legal exception exists.

In Colombia, processing of the data of children and adolescents will take place only when it responds to and respects their best interests and ensures their fundamental rights. Authorization rests with the legal representative, taking into account the minor's right to be heard when appropriate according to their maturity, autonomy, and capacity for understanding.

4. Personal data we may process

4.1 Data of the responsible adult, tutor, or subscriber

• Identification and contact data: first name, last names, country or region, email address, phone number when necessary, and data about the relationship with the learner.
• Account and authentication data: user identifier, protected credentials, login records, account status, and security preferences.
• Subscription and billing data: plan contracted, subscription status, renewal dates, transaction identifiers, and tax or billing data when necessary. Full card data may be processed directly by the payment provider and not necessarily by Bits de Inteligencia.
• Communications and support: inquiries, requests, incidents, replies, contact preferences, and evidence needed to resolve a request or exercise rights.
• Privacy preferences and consents: date, version of the notice accepted, decisions about cookies or marketing, and evidence of parental authorization when applicable.

4.2 Data of the learner or child

Minimization recommendation: when a feature can operate with an age or age range instead of the full date of birth, and when an alias can be used instead of the child's legal name, the less identifiable alternative should be preferred.

• Basic profile data: name or alias, date of birth or age, and relationship with the responsible adult.
• Educational data: level, groups or assigned content, bits program, and configuration of the sessions.
• Educational usage history: scheduled or presented sessions, content shown, dates, and statuses needed to maintain continuity of the program.
• Information the adult decides to provide in support functions, always when it is pertinent and necessary.

4.3 Technical and security data

We may process IP address, technical identifiers, browser, operating system, authentication events, error and security logs, date and time of access, and other data strictly necessary to operate, protect, and diagnose the Service. We will not use the minor's precise geolocation for the main educational function.

4.4 Sensitive data or special categories

Basic educational Service does not require medical diagnoses, clinical histories, genetic information, biometrics, or details about disability or health condition. If in the future a support or rehabilitation feature legitimately needed health information, a specific notice will be presented before its collection, explicit consent or another legal basis required by applicable law will be requested, the information solicited will be strictly limited, and reinforced safeguards will be applied. Do not send clinical histories or diagnoses through general text fields or support unless they have been expressly requested for an authorized function.

5. What we use the data for and what the basis of the processing is

6. What we do not do with children's data

• We do not sell or rent children's personal data.
• We do not use children's data for behavioral advertising or personalized ads based on cross-service tracking.
• We do not create commercial profiles of children nor infer interests for advertising purposes.
• We do not make children's profiles public nor enable by default open social features among children.
• We do not request precise geolocation to provide the main educational service.
• We do not adopt solely automated decisions that produce legal effects or effects of similar importance on a child.
• We do not condition access to an activity on the adult handing over more data about the minor than is reasonably necessary for that activity.

7. Cookies, local storage, and similar technologies

We use cookies or equivalent technologies strictly necessary for authentication, security, session continuity, and essential functions. Non-essential technologies — for example, certain analytics or measurement tools — will be activated only in accordance with the applicable consent rules and the user's preferences.

When the profile belongs to a child, the configuration should favor the highest privacy by default. We will not use behavioral advertising cookies for child profiles. Detailed information about each technology, provider, duration, and purpose must be kept in a separate Cookie Policy accessible from the preferences mechanism.

8. Providers, processors, and third parties

We may use specialized providers to deliver the Service, for example: infrastructure and hosting, storage, content delivery, authentication, transactional email, payments, support, fraud prevention, and permitted analytics. These providers may process data only according to our instructions or according to the independent function the law assigns them, and they will be subject to appropriate contractual and security obligations.

Payment providers may directly process the information necessary to process a transaction according to their own privacy policies. Bits de Inteligencia will strive to receive only the identifiers and statuses needed to manage the subscription.

9. International transfers of data

The Service may use providers or infrastructure located in countries other than the user's. When an international transfer is subject to legal restrictions, we will adopt the valid mechanism required by the applicable jurisdiction, which may include adequacy decisions, standard contractual clauses, processing agreements, transfer risk assessments, binding corporate rules, or other recognized safeguards.

For data subject to the GDPR of the European Economic Area, where necessary we will use the safeguards provided in Articles 44 to 49 of the GDPR, including the European Commission's Standard Contractual Clauses. For data subject to the UK GDPR we will use, where applicable, mechanisms recognized by the United Kingdom, such as the IDTA or the applicable international Addendum. In Colombia, the transfer and international transmission rules set out by the national data protection regime will be observed.

10. Retention and deletion

We keep data only for as long as necessary for the purposes described, to comply with legal obligations, to resolve disputes, and to protect the security of the Service. We apply reinforced minimization criteria to children's data.

11. Security and incident management

We apply technical and organizational measures appropriate to the risk, which may include access control based on need, authentication, credential protection, encryption in transit, segregation of environments, backups, event logging, vulnerability management, software updates, provider controls, and incident response procedures.

No system can guarantee absolute security. If a personal data breach occurs, we will assess the risk and make the notifications to data subjects, authorities, or customers that applicable law requires within the corresponding deadlines.

12. Rights of individuals and of parents or guardians

Depending on applicable law and the circumstances of the processing, the data subject or their representative may exercise rights of information, access, knowledge, updating, rectification, correction, erasure or deletion, restriction, objection, portability, and withdrawal or revocation of consent. They may also request information about the use of their data and file a complaint with the competent data protection authority.

12.1 Rights concerning a child's data

The father, mother, guardian, or holder of parental responsibility may request, subject to reasonable verification of identity and authority: to review the minor's data; to correct them; to request their deletion; to withdraw consent when that is the applicable basis; to refuse further collection or use; and to request information about third parties or categories of third parties to whom the data have been disclosed.

Revocation of consent does not affect the lawfulness of processing carried out before its withdrawal. Certain data may be retained when a legal obligation or a legitimate applicable exception exists, which will be explained to the requester.

12.2 Procedure to exercise rights

Colombia: data subjects may, among other rights, know, update, and rectify their data; request proof of the authorization; be informed about the use; file complaints with the Superintendencia de Industria y Comercio (Superintendence of Industry and Commerce, SIC); revoke the authorization or request deletion where applicable; and access their data free of charge under the legal terms.

1. Send the request to soporte@bitsinteligencia.com or via /legal/privacidad/solicitud.
2. State the responsible adult's name, the means of response, the right they wish to exercise, and, where applicable, the associated learner's profile.
3. Provide the minimum information reasonably necessary to verify identity and, if a minor is involved, the relationship or authority to act on their behalf. We will not request excessive documentation if a less intrusive alternative exists.
4. We will respond within the deadline required by applicable law. If we need additional information or a permitted extension, we will say so.

13. Privacy for users in the European Economic Area and the United Kingdom

When the GDPR or the UK GDPR applies, we will identify a legal basis for each processing and respect data protection principles, data subject rights, and international transfer rules. If we process a child's data on the basis of consent in relation to a direct offer of information society services, we will observe the applicable digital age of consent in the corresponding country and make reasonable efforts to verify the authorization of the holder of parental responsibility when necessary.

When processing may entail a high risk to the rights and freedoms of children, we will carry out the corresponding impact assessments and mitigation measures. For services likely accessed by children in the United Kingdom, the standards of the Children's Code will be taken into account, including high privacy by default, age-appropriate transparency, and the best interests of the child.

Contact for GDPR/UK GDPR matters: [DPO O CONTACTO DE PRIVACIDAD, SI APLICA]. Representative in the EU/United Kingdom: [COMPLETAR SI LEGALMENTE REQUERIDO].

14. Children's privacy in the United States — COPPA

When COPPA applies, before collecting personal information online from a child under 13 we will obtain verifiable parental consent, unless a permitted exception applies. The direct notice to the parent or guardian will describe the collection, use, and disclosure practices; the consent method; and the parental rights to review, delete, and refuse further collection or use.

We will not require a child to provide more personal information than is reasonably necessary to participate in an activity. We will apply reasonable security and limited retention measures to children's information subject to COPPA.

15. Marketing and communications

Communications necessary to deliver the service — for example, security, substantial changes, billing, or operation — are not considered marketing. Promotional communications will be sent only in accordance with the applicable legal basis and consent rules, and will include a simple mechanism to stop receiving them.

We do not send personalized commercial communications to child profiles nor use children's data to build advertising audiences.

16. Links and third-party services

The Service may contain links to third-party sites or services. Their privacy practices are independent and we recommend that the responsible adult review their policies before providing data. The presence of a link does not imply that Bits de Inteligencia controls the processing carried out by that third party.

17. Changes to this Policy

We may update this Policy to reflect legal, technological, or functional changes. We will publish the current version and its update date. When a change is material or requires new consent, we will use a prominent notice and, where applicable, request a new authorization before applying the modified processing.

18. Contact and complaints

Controller: Carlos Mario Toro Franco — Bits de Inteligencia

Registered address: Calle 102 # 43-35, Barranquilla, Colombia

Privacy email: soporte@bitsinteligencia.com

Phone: 323 359 6936

Form or privacy center: /legal/privacidad/solicitud

If you believe we have not properly handled a request, you may go to the data protection authority competent in your jurisdiction. In Colombia, the personal data protection authority is the Superintendencia de Industria y Comercio (SIC). In the EEA or the United Kingdom, the user may go to the supervisory authority corresponding to their residence, place of work, or place of the alleged infringement, as applicable.

19. Regulatory framework and reference standards