Privacy and Data Processing Policy

Welcome to the legalnova* Universe.

legalnova* is a consulting firm operating in the U.S. and Colombia, offering legal, accounting, and tax solutions to innovation projects across LATAM. We have 2 business verticals: Startups and Corporate.

We transform traditional practices with comprehensive, international solutions—combining innovation, technology, and continuous learning to build trust and deliver value to our clients.

Our commitment is to build a successful partnership based on clarity and trust. This policy explains how we collect, use, store, and protect your personal information in compliance with Law 1581 of 2012 and its regulatory decrees in Colombia.

By accepting our Commercial Proposal and our Terms and Conditions, you also accept the practices described in this Policy.

Who makes up legalnova*?

We are composed of different corporate entities in Colombia and the United States, allowing us to provide better service to our domestic and international clients:

Derecho + Innovación S.A.S — Tax ID (NIT) No. 901.379.407-1
D+I Business S.A.S — Tax ID (NIT) No. 901.717.602-0
DI Accounting S.A.S — Tax ID (NIT) No. 901.605.985-5
Innovación Disruptiva S.A.S. — Tax ID (NIT) No. 901.922.654-1
Legalnova LLC / Document File No. L21000064015
Legalnova Accounting LLC / Document File No. L220000419547

¿Cómo nos puedes contactar?

Teléfono: 3117101017

Correo electrónico: [email protected]

Dirección: Calle 97a # 9 – 45 Of 403 Bogotá, Colombia.

Key Definitions

Here we explain in simple terms some of the concepts you will find in this policy:

Authorization: Your prior and express consent for us to use your personal data.
Database: The organized set of your personal information that we collect and manage.
Personal Data: Any information that identifies you or makes you identifiable (such as your name, ID number, email address, etc.).
Data Controller: It is us, legalnova*, who process the data.
Data Subject: You, the owner of your personal data.
Data Processing: Any operation we perform with the information, such as collecting, storing, using, sharing, or deleting it.
Transfer and Transmission: The actions of sharing your data with other individuals or companies, whether inside or outside of Colombia, always under strict security measures.

I. Who is the Data Controller for your information?

At legalnova*, we are a group of firms, and whichever entity is party to your Commercial Proposal will act as the Data Controller. However, the group operates in a coordinated manner to protect your information.

II. What data do we collect and what do we use it for? (Purposes)

We use your personal data for the following purposes, which you authorize upon contracting our services:

A. For service delivery and administrative management:

Contract Execution: To provide you with the legal, accounting, tax, or innovation services you contracted, as described in the Commercial Proposal.
Invoicing and Payments: To generate and send invoices, manage payments, and comply with tax and accounting obligations.
Communication: To keep you updated on project progress, request information or validations, and coordinate meetings.

B. For risk management and regulatory compliance:

Identity Verification: To query your information in credit bureaus and binding lists for anti-money laundering and counter-terrorism financing (AML/CFT / LAFT) prevention.
Accounts Receivable Management: To send payment reminders and, in case of default, to contact you and initiate pre-judicial or judicial collection processes.

C. For marketing and commercial reference purposes:

Brand Usage: To mention your name and/or use your logo in our portfolio and marketing materials as a legalnova* client, unless you notify us otherwise in writing.

D. For sharing with third parties (data transmission and transfer):

Corporate Group: To share your information among the different legal entities that make up legalnova* in order to provide an end-to-end service, manage credit risk, and apply contractual measures in case of breach.
External Partners: To share or transmit your information to partner firms or expert professionals when required by the service, as identified in the Commercial Proposal.
Collection Agencies: To provide your information to an external entity specialized in debt recovery to manage overdue debt collection.
Technology Providers: To process your information using technological tools and Artificial Intelligence platforms that help us operate more efficiently, ensuring at all times that these providers comply with strict security and confidentiality protocols.

III. What are your rights as a data subject?

Access, update, and rectify your personal data.
Request proof of the authorization granted to us.
Be informed about the use of your data.
File complaints with the Superintendency of Industry and Commerce (SIC) for violations of Law 1581 of 2012 and applicable regulations.
Revoke authorization and/or request data deletion when processing does not respect constitutional and legal principles, rights, and guarantees.
Access your processed personal data free of charge.
Authorize third parties to provide them with your data.
Consult your personal information held in our database.

IV. What are legalnova’s obligations as Data Controller?

Request and retain a copy of the authorization granted by you.
Inform you about the purpose of data collection and your rights upon authorizing processing.
Maintain information under standard security controls.
Process your inquiries and claims.
Adopt an internal policies and procedures manual to ensure proper compliance with the law when handling inquiries and claims.
Inform the Data Subject, upon request, about the use given to their data.
Inform the data protection authority when security breaches occur and risks in managing your data exist.
Comply with instructions and requirements issued by the Superintendency of Industry and Commerce.

The data collected will at no time exceed the scope and purpose for which it was obtained, strictly adhering to the principle of purpose established in Law 1581 of 2012 of Colombia and its regulatory provisions.

V. Age Requirement

The Platform is intended exclusively for individuals over 18 years of age. Upon registration, a checkbox will be included with the following text:

“I acknowledge that I am over 18 years old and accept these policies,” as a measure to restrict access to minors.

VI. Database Retention Period

legalnova* will retain Personal Data for as long as the purpose for which it was collected remains active, and to meet our legal obligations.

The retention period of your information will depend on the existence of a contractual or commercial relationship, the validity of your authorization for additional purposes such as marketing, and mandatory deadlines established by applicable regulations.

Therefore, your data will be processed as long as there is a legitimate interest or legal basis for doing so. Once these periods expire, and provided there is no legal obligation to retain it, we will proceed with the secure deletion of your information.

VII. Data Transfer and Transmission

We may perform domestic and international transfers and/or transmissions of personal data, guaranteeing full compliance with Law 1581 of 2012 and other applicable data protection regulations at all times.

We will strive to ensure international transfers are always made to countries offering adequate data protection levels; otherwise, we will adopt necessary contractual and security measures to ensure the integrity, confidentiality, and legality of data processing, in accordance with provisions established by the Superintendency of Industry and Commerce (SIC) and the Law.

Furthermore, transfer and/or transmission of personal data will occur with your express authorization as Data Subject, except for legal exceptions or when necessary for the performance of a contract between you and legalnova*.

In all cases, legalnova* will strive to ensure third-party recipients of personal data comply with adequate protection standards and adopt necessary measures for proper processing, aligned with principles of legality, security, and confidentiality established by current legislation.

Consequently, you agree that your personal data may be transferred and/or transmitted domestically or internationally. Revocation of your consent will only have prospective effect, without affecting the validity or legality of processing actions or decisions made prior to said revocation, which will remain under the terms under which they were carried out.

IX. Information Security

At legalnova*, we are required to comply with all applicable regulations regarding personal data security measures. To this end, we use industry standards for confidentiality protection, including measures such as firewalls and Secure Socket Layers (“SSL”), and employ various security techniques to protect data against unauthorized access.

All received information is stored on secure servers where appropriate technical and organizational measures have been implemented to protect data; we continuously evaluate network security and internal security programs designed to:

Help keep data secure against loss, accidental, or unlawful access or disclosure.
Identify reasonably foreseeable security risks for the legalnova* network.
Minimize security risks through regular evaluations and verifications.

Notwithstanding the above, and considering that the internet is an open and publicly accessible system, legalnova* cannot guarantee that unauthorized third parties will not eventually bypass security measures and misuse Personal Information.

X. How to submit data processing requests?

If you have any questions or requests regarding the processing of your data, contact us at: [email protected]

We will respond to your request within a maximum of 15 business days. Your query must contain:

Your full name, identification, and contact number or email.
Description of the Data you wish to consult.
Description of your inquiry or request.
Supporting documents, if applicable.

If the query does not include these requirements, we will inform you within 5 days of receipt. You will have 2 months to correct it; if you do not, we will consider the request withdrawn.

XI. Legal Framework

This policy and our commitment to protecting your data are governed by Colombian regulations, particularly Law 1581 of 2012, Decree 1377 of 2013, and any regulations modifying, adding to, or supplementing them.

XII. Policy Modifications

We may modify this Policy at any time. To do so, we will publish a notice on the website or through any enabled medium 15 business days prior to implementing changes during the policy’s validity.

If you do not agree with the new Policy, you may request the withdrawal of your information via the email address indicated above. However, you cannot request data deletion while maintaining an active relationship with legalnova*.

This Policy is effective as of October 2025.