Data Processing
1. Legal Framework and Data Controller
In strict compliance with the provisions of Statutory Law 1581 of 2012, Regulatory Decree 1377 of 2013, and other regulations governing the protection of the right to Habeas Data in Colombia, this Personal Data Processing Policy is adopted by: Corporate Name: PINGÜINO CAPITAL S.A.S. NIT: 901151726-4.
2. Conceptual Framework and Definitions
For the proper interpretation of this document by our corporate partners and authorities, the following legal definitions are adopted:
Platform / Pingüino: The B2B software infrastructure, APIs, and dashboards provided by the Company for payment orchestration.
Data Subject: Natural person whose personal data is subject to Processing.
Client: Corporate entity, BPO, or merchant that contracts Pingüino's technological services (B2B).
Data Controller: Natural or legal person who, by themselves or in association with others, decides on the database and/or the purposes and means of the processing of personal data. This status may apply to the Client or to PINGÜINO CAPITAL S.A.S., depending on the nature of the relationship and the processing activities performed.
Data Processor: Natural or legal person who carries out the processing of personal data on behalf of the Controller, following their instructions and within the authorized purposes.
3. Role Doctrine in Technological Architecture (B2B)
PINGÜINO CAPITAL S.A.S. provides technological infrastructure for payment orchestration and the operational management of transactions. Its involvement in the processing of personal data is determined according to the nature of each contractual relationship and the purposes actually carried out.
Role as Data Controller: PINGÜINO will act as Data Controller regarding personal data whose collection, use, and processing it directly determines, including information of corporate clients, legal representatives, business contacts, and beneficiaries directly linked to its registration processes, identity validation, due diligence, fraud prevention, transactional monitoring, and compliance with legal or contractual obligations.
Role as Data Processor: When PINGÜINO processes personal, financial, or transactional information on behalf of a corporate Client and pursuant to its instructions, it will act as Data Processor, within the limits of authorized purposes and applicable agreements.
Separation of Responsibilities: The status of Data Controller or Data Processor will be determined according to the functions actually assumed in each operation. Use of the Platform does not imply that PINGÜINO automatically assumes the Client's obligations regarding underlying commercial relationships, nor that the Client is exempt from its own obligations regarding personal data protection.
4. Purposes of Information Processing
The collection, storage, use, distribution, transmission, or transfer of data will be carried out lawfully, for the following restrictive purposes:
4.1. Technological and Operational Purposes
Allow secure access, authentication, and use of the Platform and the API.
Orchestrate, parameterize, and route the payment instructions received.
Provide technical support, troubleshooting (troubleshooting), and systems auditing.
4.2. Regulatory Compliance Purposes (SAGRILAFT/AML)
Transmit transactional and identity information to underlying financial networks and Third-Party Partners for due diligence execution (KYC/KYB).
Prevent, monitor, and report the risk of money laundering, terrorist financing, foreign exchange evasion, or transactional fraud. These controls are described on our Compliance and Risk Management page.
4.3. Administrative Purposes
Manage billing, collection of technology fees, and reporting to competent tax authorities (DIAN).
Notify changes to the Terms of Service or this Policy.
5. Client Obligations (Pinguino's Waiver of Liability)
Corporate Clients who use PINGÜINO's technological infrastructure will be responsible for ensuring that the personal information provided to the Platform has been obtained and processed in accordance with applicable law.
In particular, the Client must:
Obtain the prior, express, and informed consents that are legally required for processing the personal data of its users, contractors, or beneficiaries.
Inform data subjects about the involvement of technological and financial providers, including PINGÜINO CAPITAL S.A.S., where applicable.
Ensure the accuracy, legitimacy, and updating of the information transmitted through the Platform.
Be held accountable for the obligations that legally correspond to it in its capacity as Data Controller, holding PINGÜINO harmless against claims arising from breaches directly attributable to the Client, to the extent permitted by applicable law.
When PINGÜINO establishes a direct operational relationship with a beneficiary, it will assume the legal responsibilities that apply to it regarding the processing of personal data that it determines and carries out for its own purposes of identification, due diligence, fraud prevention, compliance, and operational execution.
The existence of such an operational relationship does not make PINGÜINO a party to the underlying business relationship between the originating Client and the beneficiary, nor does it imply liability for the determination of fees, compensation, or economic terms agreed upon between them.
6. Cross-Border Flow and Transmission to Third-Party Allies
The nature of the cross-border service makes the flow of data technologically imperative. The Holder and the Client irrevocably authorize Pingüino to transmit and/or transfer the databases to:
Third-Party Allies: Financial institutions, payment processors, exchanges, and acquirers (domestic or foreign) in charge of carrying out the clearing of funds.
Cloud Providers: Server hosting and cybersecurity companies located outside Colombian territory (e.g., USA, Europe), which have adequate levels of data protection according to international standards.
7. Processing of Sensitive Data and Minors
As a general rule, Pingüino does not require the processing of sensitive data. However, within the framework of the identity validation required by Third-Party Partners (KYC), information such as images of the identity document or facial recognition could be routed. The processing of this data is strictly voluntary. Pingüino prohibits the use of its API for processing transactions involving sensitive data of minors without the express authorization of their legal representatives.
8. Rights of data subjects (ARCO Rights)
In accordance with Article 8 of Law 1581 of 2012, data subjects possess the following rights:
To access, update, and rectify their personal data.
To request proof of the authorization granted to the Controller.
To be informed about the use that has been made of their data.
To file complaints with the SIC for violations of the regulations.
To revoke the authorization and/or request the deletion of the data, provided that there is no legal or contractual duty that obligates Pingüino to maintain it in its database (See Section 11).
9. Responsible Department and Customer Service Channels (PQRS)
To guarantee the exercise of the Data Subjects' rights, the compliance management of Pingüino Capital S.A.S. will act as the responsible department. For the purposes of legal notifications, requests from the Superintendency of Industry and Commerce, and handling Habeas Data requests, the following sole and official channels are established:
Address for Notification: Calle 17 A SUR 44 170 OF 102, Medellín, Antioquia, Colombia.
Official Emails: info@pinguinopay.com
10. Regulated Procedure for Inquiries and Claims
To guarantee due process, Pingu00fcino establishes the following procedure:
Inquiries: The Data Subject may consult their information by sending a request to the authorized emails. Pingu00fcino will respond within a maximum term of ten (10) business days. If it is not possible to address it within said term, the reasons will be informed and it will be answered within a maximum of five (5) additional business days.
Claims (Correction, Update, or Deletion): The claim must include the identification of the Data Subject, a description of the facts, the address, and the supporting documents. If the claim is incomplete, the interested party will be required to complete it within the following five (5) days. If two (2) months pass without a response from the applicant, it will be understood as withdrawn. The maximum term to address the complete claim will be fifteen (15) business days, extendable by eight (8) additional days if the technical complexity warrants it.
Processing of Claims as a Processor: If Pingu00fcino receives a claim from an end user of the Client (where Pingu00fcino is only a Data Processor), the Company will transfer the claim to the Client (Data Controller) within a period of two (2) business days, notifying the applicant of this.
11. Exceptional Retention Policy (SAGRILAFT) and Security
Pingüino adopts technical, human, and administrative measures (database encryption, access controls) to ensure the security of the records.
Exception to Deletion: Although the Data Subject has the right to request the deletion of their data, Pingüino reserves the right to deny such deletion and retain transactional, corporate, and identity metadata for a period of five (5) to ten (10) years when such retention is required by anti-money laundering (AML) laws, tax regulations, or requirements from regulated Third-Party Allies.
12. Term and Modifications
This Data Processing Policy becomes effective upon its publication. The databases will remain in effect for the time necessary to fulfill the purposes described herein or as required by law. Pingüino reserves the right to make substantial modifications to this document, which will be communicated to the Client in a timely manner through corporate channels.
Modernize your global operation.
PinguinoPay coordinates international disbursements through multi-rail infrastructure designed for precision, redundancy, and operational scale.