PERSONAL DATA PROCESSING AND MOBILE APPLICATION PRIVACY POLICY

EXIA S.A.S. – NIT (Tax ID) 901504091-2
Renewable energy services provider (installation, maintenance, telemetry and monitoring of solar photovoltaic systems)

  • Version: 2.0 (Updated for the Mobile Ecosystem and Digital Services)
  • Effective date: October 19, 2026
  • Data controller: EXIA S.A.S.
  • Address: Cartagena de Indias – Bolívar, Colombia
  • Inquiries, complaints and data protection email: soporte@exia.com.co / protecciondedatos@exia.com.co
  • Website: https://www.exia.com.co/en/privacy/

This is an English translation of the Spanish policy published at https://www.exia.com.co/privacidad/. In case of any discrepancy, the Spanish version prevails.

1. Scope, Websites and Applications Covered

This Policy applies to all personal data collected by EXIA S.A.S. through its on-site services, its web platforms and the ecosystem of mobile applications developed for its energy and commercial operations:

  1. SUE Clientes: Mobile application for customers and end users to view solar generation, self-consumption, surplus energy, estimated billing, monthly reports and support.
  2. SUE Terrena: Technical and operational application for installers, field technicians and site supervisors to carry out and close work orders (WO), keep field logs and perform preventive/corrective maintenance.
  3. SUE CRM: Commercial and administrative application for managing customers, prospects, solar project follow-up, quotes and document attachments.
  4. EXIA website (https://www.exia.com.co): Informational site with the contact form and the online solar quote tool.
  5. SUE web platform (https://sue.exia.com.co): Web version of the Unified Energy System (Sistema Unificado de Energía) for customers and EXIA staff (plant monitoring, reports, sales, field works and inventory), including the commercial proposals shared with customers through a link.

EXIA S.A.S. processes personal data in strict compliance with:

  • Statutory Law 1581 of 2012 (Colombia’s General Personal Data Protection Regime).
  • Decree 1074 of 2015 (Chapter 25 – Regulation of Data Processing).
  • The data safety policies of the Google Play Store and the Apple App Store.

3. Data Collected in the Applications and Web Platforms

Depending on the application used, we only collect the data that is necessary and proportionate to provide our services:

3.1 SUE Clientes

  • Account data: Email address, name or company name, and access credentials authenticated with encrypted tokens.
  • Plant telemetry and energy: Photovoltaic generation metrics (kWh), self-consumption, surplus energy exported to the grid, inverter alerts, consumption history and the energy retailer’s tariff information.
  • Push notifications: Device registration token through Google Firebase Cloud Messaging (FCM), used to send priority operational notifications (fault alerts for the photovoltaic plant and availability of monthly reports).
  • Network access: Internet access and network state permissions, to ensure secure synchronization with the SUE cloud.

3.2 SUE Terrena

  • Foreground location (precise and approximate location):
    • Strictly work-related and safety purpose: Used to confirm that technical staff are present at the coordinates assigned to the service, to record start and end of work check-ins, to verify on-site geofences and for Occupational Health and Safety (OHS).
    • Privacy guarantee: Location is captured ONLY at specific moments linked to a Work Order assigned to the technician: when checking in and out (when starting and finishing the WO), when recording WO status changes and when taking evidence photos. There is no continuous or background tracking, and no location is collected, transmitted or stored outside assigned work orders, during personal travel, on days off or after logging out.
    • Periodic recording during a WO: Not enabled today. If periodic location recording while a WO is “In Progress” is enabled in the future, the technician’s consent will be requested first and the device will show a persistent foreground notification for as long as it lasts.
  • Camera and photos: Used to capture photographic evidence before, during and after technical work (inspection of panels, inverters, electrical boards and metering equipment) and for the check-in verification photo described below.
  • Check-in verification photo (selfie): Only requested when a check-in needs verification (location outside the assigned area, inaccurate, simulated or unavailable). The image of the technician’s face is sensitive data and is handled as described in section 8.
  • Digital handwritten signature: Capture of the signature drawn on the touchscreen by the customer or supervisor to formalize and accept the service handover record.
  • Push notifications: Device registration token through Google Firebase Cloud Messaging (FCM), used to notify technicians of work orders assigned to them or rescheduled.

3.3 SUE CRM

  • Commercial and contact data: Names, phone numbers, emails and addresses of customers or prospects interested in solar energy projects.
  • Project documents: Voluntary upload of files and utility bills required for the technical sizing of solar systems.
  • Notifications: Commercial reminders and follow-up of operational tasks.

3.4 EXIA website (www.exia.com.co)

  • Contact form and solar quote tool: Name, email address, phone number, energy bill amount, monthly consumption, need for battery backup and backup hours, and any message the person chooses to leave. They are used to prepare the quote and contact the person.
  • Technical submission data: The IP address and browser type from which the form is submitted, to prevent automated submissions and abuse.
  • Browsing: Google Analytics measurement cookies, as described in section 12.
  • WhatsApp: WhatsApp contact links open that service, which processes data under its own policy.

3.5 SUE web platform (sue.exia.com.co)

  • Account data: Name, email address, role and access credentials. Passwords are stored encrypted and never in readable text.
  • Operational data: The same plant, customer, project, work order and inventory data described in sections 3.1 to 3.3, according to each user’s role.
  • Activity log: For platform security, logins and logouts, failed attempts, actions that modify information, screens opened, the date and the IP address are recorded. Only authorized EXIA S.A.S. staff can consult this log, and it does not store form contents or passwords.
  • Browser session: The session token is kept in the browser’s local storage and deleted on logout. The platform uses Google Analytics measurement cookies (section 12) and does not use advertising cookies.
  • Commercial proposals: When a customer accepts a proposal from its link, the date and IP address of the acceptance are recorded.

4. Purposes of Processing

Personal data is processed for the following legitimate purposes:

  1. Providing access to real-time telemetry and energy savings dashboards for solar plants.
  2. Coordinating, carrying out and verifying the proper provision of engineering, installation and preventive/corrective maintenance services.
  3. Producing and delivering periodic energy and environmental performance reports (tonnes of CO₂ avoided).
  4. Managing technical equipment warranties and post-installation support.
  5. Managing information security, secure authentication and the prevention of unauthorized access.
  6. Handling information and quote requests received through the website, and following up on the commercial relationship.

5. Security and Local Storage of Information

  • All communications between the mobile applications, the website, the SUE platform and EXIA S.A.S. servers use encrypted channels over HTTPS with TLS 1.2 or higher.
  • Credentials and session tokens are stored on the mobile device in the operating system’s secure storage (Android and iOS), encrypted by hardware.
  • No sale of data: EXIA S.A.S. does not trade, rent, sell or transfer personal or location data to third parties for advertising or data brokerage purposes.

6. Account Deletion and Data Erasure Procedure

In line with Google Play standards and Law 1581 of 2012, any user who is a data subject has the right to request the closure of their account and the full deletion of their associated personal data:

How to request deletion

  1. By email: Send a request from the email address registered in the app to soporte@exia.com.co or protecciondedatos@exia.com.co, with the subject “Account Deletion Request - [App Name]”.
  2. From the application: In the profile or user settings options, select “Request account deletion”.
  • The request will be processed within a maximum of ten (10) business days.
  • Once confirmed, access credentials will be deactivated and the user’s personal and profile data will be securely deleted.
  • Retention limited to legal duties: Under Colombian law (Commercial Code and Tax Statute), EXIA S.A.S. will retain only the accounting records, billing records and technical warranty documentation required by law for the applicable tax periods, after which they will be anonymized or destroyed.

7. Data Subject Rights (Habeas Data)

The data subject may at any time, free of charge, exercise their rights to know, update, rectify and delete their personal data, and to revoke the authorization granted. They may also request proof of the authorization, be informed of how their data has been used, access it and file complaints with the Superintendence of Industry and Commerce (SIC). To do so, write to:

  • soporte@exia.com.co / protecciondedatos@exia.com.co
  • Attention: Personal Data Protection Officer - EXIA S.A.S.
  • Physical address: Barrio Bosque, Cartagena de Indias, Colombia.

7.1 Inquiries

The data subject may submit inquiries about their data. The request must include: name, identification, a description of the inquiry and contact details for the reply. Inquiries will be answered within a maximum of ten (10) business days from receipt; if this is not possible, the reasons and the new date will be communicated, which will not exceed five (5) additional business days.

7.2 Complaints

The data subject may file complaints for correction, update, deletion or revocation. They must include: identification, a description of the facts, an address/email for notifications and supporting documents if applicable. If a complaint is incomplete, the data subject will be asked to complete it within the following five (5) days; if two (2) months pass without a response, the complaint will be considered withdrawn. Complaints will be answered within a maximum of fifteen (15) business days from the day after receipt; if this is not possible, the reasons and the new date will be communicated, which will not exceed eight (8) additional business days.

EXIA S.A.S. may request additional information to verify identity and protect the data subject’s data.

8. Sensitive Data

EXIA S.A.S. does not request sensitive data to provide its ordinary services to customers. The only exception is the check-in verification photo in SUE Terrena (section 3.2), which contains the image of the technician’s face. It is only requested when a check-in needs verification, is used solely to confirm the technician’s presence at the service, and is only visible to the technician and to the EXIA S.A.S. administrative staff who review check-ins. The technician is not required to authorize its processing: if they do not take the photo, the check-in is still recorded and left for review by the administrative staff.

In any other exceptional case in which sensitive data is required, the data subject will be informed that they are not required to authorize its processing, and their explicit authorization will be requested.

9. Processing of Minors’ Data

EXIA S.A.S. does not knowingly collect data from minors.

10. Processors, Transmission and Transfer of Data

To operate its services, EXIA S.A.S. may engage processors (service providers) such as:

  • Cloud, hosting, corporate email, messaging, CRM or ticketing services.
  • Mobile device notification services (Google Firebase Cloud Messaging).
  • Device monitoring or management platforms (inverter and meter manufacturers/integrators).
  • Web analytics (Google Analytics), database or storage providers.

In these cases, EXIA S.A.S. will require reasonable security, confidentiality and regulatory compliance measures.

International transfers: Some of these providers have infrastructure outside Colombia. In those cases, EXIA S.A.S. will seek to ensure adequate protection standards and compliance with the applicable legal requirements.

11. Data Retention and Deletion

Personal data will be kept for as long as necessary to fulfill the purposes described and/or legal and contractual obligations, including warranty, support, billing and claims-handling periods.

Once the purpose has been fulfilled or the applicable periods have expired, EXIA S.A.S. will delete, block or anonymize the data, as appropriate and technically possible.

12. Cookies and Web Analytics

The EXIA S.A.S. website and the SUE web platform use cookies and similar technologies for:

  • Operation and security (necessary cookies).
  • Analytics and experience improvement (Google Analytics measurement cookies), which statistically record the pages visited, the type of device and the source of the visit.

Users can manage or block cookies from their browser. If necessary cookies are disabled, some features may be affected.

13. Changes to this Policy

EXIA S.A.S. reserves the right to update this policy in accordance with new regulations or improvements to its applications. Updates will be permanently published and accessible at: https://www.exia.com.co/privacidad/ (Spanish) and https://www.exia.com.co/en/privacy/ (English).

14. Effective Period

This Policy is effective as of October 19, 2026 and replaces version 1.0, in force since 01/01/2024. The databases in which personal data is recorded will remain in force for as long as EXIA S.A.S. processes personal data in the course of its activities and during the retention periods described in section 11.