Contract · 03
Privacy and Personal Data Processing Policy
NexToCloud (nextocloud.ai) · NTC CAPITAL HOLDING S.A.S. · NIT (Colombian tax ID) 902.096.121-7 Version 2.0 · Effective as of: October 20, 2026 · Last updated: October 20, 2026
1. Identification of the Controller#
| Legal name | NTC CAPITAL HOLDING S.A.S. ("NexToCloud") |
| NIT | 902.096.121-7 |
| Domicile | Bogotá D.C., Colombia |
| Address | Carrera 112 F # 72 C - 03, Torre 9, Apartamento 102, Engativá, Bogotá D.C. |
| Data protection email | privacidad@nextocloud.ai |
| Phone / WhatsApp | +57 313 218 8036 |
| Website | https://nextocloud.ai |
Swipe the table to the right to see all columns.
This Policy is issued in compliance with Article 15 of the Colombian Political Constitution, Law 1581 of 2012, Decree 1377 of 2013 (compiled in Chapter 25 of Decree 1074 of 2015), and any other rules that amend or supplement them.
2. Scope#
This Policy applies to the personal data that NexToCloud collects and processes by any means (website, forms, Platform, applications, email, WhatsApp, calls, events, and customer service channels) (the "Collection Channels"), with respect to the following groups of data subjects (the "Stakeholder Groups"):
- Prospects and visitors to the website and commercial channels.
- Customers: legal representatives, contacts, Administrators, and Authorized Users of the businesses that contract the Services.
- Suppliers and partners and their contacts.
- Candidates, employees, and contractors of NexToCloud.
- Shareholders of NTC CAPITAL HOLDING S.A.S.
3. NexToCloud's role depending on the context#
| Context | NexToCloud's role | Governing document |
|---|---|---|
| Website, forms, commercial and support channels, billing, user account management, suppliers, candidates, and shareholders | Controller (data controller — Responsable del Tratamiento under Law 1581 of 2012) | This Policy |
| Data that a Customer uploads or generates on the Platform about its own customers, patients, end users, or staff (for example, appointments, WhatsApp messages, call recordings) | Processor (data processor — Encargado del Tratamiento under Law 1581 of 2012), on behalf of and under the instructions of the Customer, which is the Controller | Data Processing Agreement (Processor) and the Customer's data processing policy |
Swipe the table to the right to see all columns.
4. Data we collect#
4.1. Data you provide to us
| Category | Examples |
|---|---|
| Identification | Name, type and number of identification document, job title, company. |
| Contact | Email, phone, WhatsApp, city, address. |
| Account | Username, encrypted credentials, role, preferences, authentication factor. |
| Commercial and billing | Legal name, NIT, RUT (Colombian tax registration), billing details, payment history, bank information for payments and refunds. |
| Communications | Support requests, messages, emails, surveys, recordings or transcripts of calls with NexToCloud (with prior notice), petitions, complaints, and claims. |
| Candidates and employees | Résumé, education, experience, references, and the information necessary for the employment or contractual relationship. |
Swipe the table to the right to see all columns.
We also process data from forms that were started but not submitted solely to remind you to complete your request, if you have authorized us to do so.
4.2. Data collected automatically
IP address, device and browser type, operating system, time zone, approximate location derived from the IP address, pages visited, actions on the Platform, access dates and times, technical records (logs), and data obtained through cookies and similar technologies (section 13).
4.3. Data obtained from third parties
Professional contact data provided by partners, referrals, or public sources, where permitted by law. Anyone who provides us with another person's data represents that they have that person's authorization to do so.
4.4. Sensitive data and data of minors
- As Controller, NexToCloud does not request or require Sensitive Data from customers, prospects, or users to manage the relationship. You are not required to provide Sensitive Data.
- Any Sensitive Data that exists within a Customer Workspace (for example, patient health data) belongs to the Customer and is processed under the Processor regime (section 3).
- The Services are not directed to minors, and NexToCloud does not knowingly collect their data as Controller.
5. Processing to which the data is subject#
NexToCloud may collect, store, organize, use, update, rectify, analyze, circulate on a restricted basis, transmit, back up, and delete personal data, by its own means or through its Processors, including analytics and artificial intelligence tools subject to the safeguards in section 10, exclusively for the purposes set out in section 6. NexToCloud does not sell personal data.
6. Purposes#
6.1. Prospects, customers, and their users
a) Respond to requests for information, demos, and quotes. b) Enter into, perform, and administer the contract: create and manage accounts, authenticate users, and provide support, maintenance, and training. c) Invoice, collect payments, manage accounts receivable, and comply with accounting and tax obligations. d) Send operational and security communications and notices of changes to the Services or the Legal Documents. e) Verify identity and prevent fraud, unauthorized access, and uses contrary to the Acceptable Use Policy. f) Measure satisfaction, analyze use of the Platform, and improve the Services, preferably using aggregated or anonymized data. g) Send commercial information, events, and news about NexToCloud, only with authorization and with the option to opt out at any time. h) Keep records of communications and of acceptance of documents as evidence. i) Screen against restrictive lists for the prevention of money laundering, terrorist financing, and corruption. j) Respond to requests from authorities and exercise or defend rights in judicial or administrative proceedings.
6.2. Suppliers and partners
Evaluate, engage, and manage the relationship; make payments; verify references and restrictive lists; communicate process changes; and comply with legal obligations.
6.3. Candidates, employees, and contractors
Manage recruitment processes, verify references, perform the employment or contractual relationship, comply with social security obligations and reporting to authorities, and manage training and well-being. Data of candidates who are not selected is retained for up to one (1) year for future recruitment processes, unless the data subject requests its deletion.
6.4. Shareholders
Manage the corporate relationship, call shareholders' meetings, record corporate acts, and comply with legal and reporting obligations.
NexToCloud will not use the data for different purposes without informing the data subject and, where applicable, obtaining a new authorization.
7. Authorization#
7.1. NexToCloud obtains the data subject's authorization in advance, expressly, and on an informed basis, through means that allow it to be consulted later: non-pre-checked acceptance boxes in forms and on the Platform, signature of contracts, electronic acceptance of the Terms, data messages, or unequivocal conduct.
7.2. Authorization is not required in the cases set out in Article 10 of Law 1581 of 2012, including data of a public nature, information required by an authority in the exercise of its functions, and cases of medical or health emergency.
7.3. NexToCloud keeps evidence of each authorization: date, time, means, version of the accepted document, and the data subject's identifier.
8. Recipients of the data#
NexToCloud may share personal data, subject to a duty of confidentiality, with:
a) Technology Processors (cloud, email, messaging, telephony, analytics, artificial intelligence), in accordance with the Sub-processor List published at nextocloud.ai/legal. b) Accounting, tax, and legal advisors and auditors. c) Financial institutions for payment processing. d) Authorities that require it in the exercise of their functions. e) Companies within its business group or a potential successor in the event of a merger, spin-off, or acquisition, that assume the obligations of this Policy.
9. International transfers and transmissions#
9.1. The Platform and some of its providers operate from infrastructure located outside Colombia, mainly in the United States (Microsoft Azure, East US 2 and Central US regions) and in the regions of the other providers listed in the Sub-processor List.
9.2. When NexToCloud sends data to a Processor located outside Colombia, it carries out an international transmission covered by a transmission agreement with equivalent protection clauses, in accordance with Decree 1074 of 2015, Article 2.2.2.25.5.2. International transfers are made to countries with an adequate level of protection according to External Circular 005 of 2017 of the Superintendence of Industry and Commerce (SIC), or on the basis of the other grounds set out in Article 26 of Law 1581 of 2012.
9.3. By accepting this Policy, the data subject expressly authorizes the international transfer and transmission of their data for the purposes set out in section 6.
10. Security and artificial intelligence#
10.1. NexToCloud applies technical, human, and administrative measures to protect data against loss, tampering, and unauthorized consultation, use, or access, as described in the Information Security Policy, including: encryption in transit and at rest, a separate database for each customer, strong authentication, role-based access control, vault-based secrets management, event logging, and backups.
10.2. No measure is infallible. In the event of an incident affecting personal data, NexToCloud will manage it in accordance with its incident procedure, will notify data subjects where applicable, and will report it to the Superintendence of Industry and Commerce within the legal time frames.
10.3. When NexToCloud uses artificial intelligence tools to process personal data, it does so under the principles of SIC External Circular 002 of 2024: limited purpose, minimization, human oversight, transparency, and security. NexToCloud does not use personal data to train general-purpose AI models and does not make decisions with legal effects on data subjects based solely on automated processing.
11. Rights of data subjects#
Under Article 8 of Law 1581 of 2012, the data subject has the right to:
a) Know, update, and rectify their data with NexToCloud or its Processors. b) Request evidence of the authorization granted, except where it is not required. c) Be informed, upon request, of the use made of their data. d) File complaints with the Superintendence of Industry and Commerce, once the inquiry or claim procedure before NexToCloud has been exhausted. e) Revoke the authorization and/or request deletion of their data, when the legal principles, rights, and guarantees are not respected and there is no legal or contractual duty to retain the data. f) Access free of charge the personal data being processed, at least once every calendar month and whenever there are substantial changes to this Policy.
These rights may be exercised by the data subject, their successors in interest, their representative or attorney-in-fact, and anyone acting under a stipulation in favor of another.
12. Responsible area and procedure for exercising rights#
12.1. Responsible area. NexToCloud's Data Protection Area, headed by the legal representative, handles inquiries and claims from data subjects.
12.2. Channels: email privacidad@nextocloud.ai and written communication to the address in section 1. The request must state: the data subject's full name and identification, a clear description of what is requested, an address or email for the response, and, if a third party is acting, the document evidencing their capacity.
12.3. Inquiries. Inquiries are answered within a maximum of ten (10) Business Days from receipt. If this is not possible, the requester will be informed of the reason and the new date, which will not exceed five (5) Business Days beyond the initial term.
12.4. Claims (correction, update, deletion, or non-compliance):
a) If the claim is incomplete, the requester will be asked to cure it within five (5) days after its receipt. If two (2) months pass without the requester doing so, the claim will be deemed withdrawn. b) If NexToCloud is not competent to resolve it (for example, because the Controller is a Customer), it will forward the claim to the appropriate party within two (2) Business Days and will inform the requester. c) Once the complete claim is received, the legend "claim in process" (reclamo en trámite) will be added to the database within two (2) Business Days and will remain until the claim is decided. d) The claim will be resolved within fifteen (15) Business Days after the complete claim is received. If this is not possible, the requester will be informed of the reason and the new date, which will not exceed eight (8) Business Days beyond the initial term.
12.5. Procedural prerequisite. The data subject may only file a complaint with the Superintendence of Industry and Commerce once they have exhausted the inquiry or claim procedure before NexToCloud (Article 16 of Law 1581 of 2012).
13. Cookies and similar technologies#
13.1. The website and the Platform use:
| Type | Purpose | Is acceptance required? |
|---|---|---|
| Essential | Authentication, session, security, load balancing, language preferences. | No. The service does not work without them. |
| Analytics | Measure visits and usage to improve the website. | Yes, through the cookie banner. |
| Marketing | Measure campaigns and display relevant advertising. | Yes, through the cookie banner. |
Swipe the table to the right to see all columns.
13.2. You can accept, reject, or configure non-essential cookies from the banner or the "Cookie preferences" link, and block them from your browser. Blocking essential cookies may prevent use of the Platform.
13.3. Details of the cookies used, their purpose, and their duration are set out in the Cookie Policy, published at nextocloud.ai/legal/cookie-policy.
14. Data retention#
Data is retained for as long as it is necessary for the purposes that justified its processing, for as long as the contractual relationship continues, and for the additional period required by accounting, tax, or commercial rules (generally, ten (10) years for a merchant's books and records) or for the defense of rights. Once these periods have elapsed, the data is securely deleted or anonymized. Data processed as Processor is retained and deleted in accordance with the Customer's instructions and the Terms.
15. National Database Registry#
NexToCloud will register its databases in the National Database Registry (RNBD) administered by the Superintendence of Industry and Commerce when it is required to do so under applicable regulations.
16. Effectiveness and amendments#
16.1. This Policy is effective as of the date indicated in its header. The databases will remain in effect for as long as necessary to fulfill their purposes.
16.2. Substantial changes, particularly to the identification of the Controller or to the purposes, will be communicated before they are implemented through the website, the Platform, or the registered email address and, where applicable, a new authorization will be requested. Previous versions are kept at nextocloud.ai/legal.
17. Glossary#
- Authorization: the data subject's prior, express, and informed consent to the processing of their data.
- Privacy Notice: a verbal or written communication that informs the data subject of the existence of this Policy and the purposes of the processing.
- Database: an organized set of personal data subject to processing.
- Personal data: information linked or that may be associated with a specific or identifiable natural person.
- Public / semi-private / private data: categories defined by Law 1581 of 2012 and Law 1266 of 2008 according to their level of access.
- Sensitive Data: data that affects the data subject's privacy or whose misuse may lead to discrimination, such as health data, biometric data, racial origin, political orientation, or sex life.
- Processor (Encargado del Tratamiento): the party that processes personal data on behalf of the Controller.
- Controller (Responsable del Tratamiento): the party that makes decisions about the database and/or the processing.
- Data Subject (Titular): the natural person whose data is subject to processing.
- Transfer (Transferencia): the sending of data to a Controller located inside or outside Colombia.
- Transmission (Transmisión): the communication of data to a Processor, inside or outside Colombia, so that it processes the data on behalf of the Controller.
- Processing (Tratamiento): any operation on personal data, such as collection, storage, use, circulation, or deletion.
Versioned document. Previous versions are kept at nextocloud.ai/legal as a record of the terms accepted.
Exercise your Habeas Data rights
As a data subject you may access, update, rectify and delete your personal data, and withdraw the authorisation you granted, under Colombian Law 1581 of 2012.
Write to privacidad@nextocloud.ai stating your full name, your ID, a clear description of your request and your contact details.