Version: 5

Last Updated: February 9, 2026

1. Data Controller and Legal Framework

GESTRAL SAS (represented by its Legal Representative, Nicolas Raute) acts as the Data Controller in compliance with Law 1581 of 2012 and its regulatory decrees (HÁBEAS DATA) in the Republic of Colombia. This policy governs the processing of personal information of our "Associated Parties" (clients, leads, suppliers, and partners) collected through our digital media, including websites, social media, WhatsApp, and APIs.

2. Purposes of Data Processing

GESTRAL collects and processes personal data for the following business purposes:

• CRM and Lead Management: Managing records, support, and sales pipelines within GOPLUS / Go High Level.

• Payment Processing: Facilitating commercial transactions through Stripe and PayPal.

• Marketing Communications: Sending promotions, updates, and educational content via email, SMS, WhatsApp, or social media.

• Analytics and Optimization: Measuring user behavior and conversion rates to improve service delivery.

3. Advanced Tracking and Analytics

To provide a high-quality digital experience, GESTRAL utilizes advanced tracking methods, which the user accepts:

• Server-Side Tracking: Data processing via Stape.io to improve privacy and data integrity before transmitting information to analytics platforms.

• Conversion APIs: Implementation of Google Measurement Protocol and Meta Conversions API to track interactions directly from the server level.

• Analytics Tools: Use of Google Analytics, Google Tag Manager, Metricool, and Meta Pixel.

• Technical Identification: Use of cookies and fingerprinting for pseudonymized statistical analysis.

4. International Data Transfer

Because our service providers (such as Google, Meta, Stape.io, GoHighLevel, and Stripe) are primarily located in the United States and the European Union, the Data Subject grants express consent for the international transfer and transmission of their personal data. GESTRAL relies on the security protocols and privacy standards established by these global providers to protect the confidentiality of your information.

5. Rights of the Data Subject

As a Data Subject, you are entitled to:

1. Access, update, rectify, or request the deletion of your personal data.

2. Request proof of the authorization granted to GESTRAL.

3. Be informed about how your data is being used upon request.

4. File formal complaints with the Superintendence of Industry and Commerce (SIC) in Colombia.

5. Revoke your consent when legal or constitutional principles are not being upheld.

6. Inquiries and Claims Procedure (PQR)

To exercise your rights, please contact datos @ gestral.com.

• Inquiries: Responses will be provided within ten (10) business days.

• Claims: If a claim is incomplete, the user will be notified within 5 days to provide missing information. Once complete, GESTRAL will flag the record as a "claim in progress" within 2 business days. The maximum resolution period is fifteen (15) business days.

7. Third-Party Data Indemnification

Any party providing third-party personal data to GESTRAL warrants that they have obtained prior, express, and informed consent from the Data Subjects. The providing party agrees to indemnify and hold GESTRAL harmless against any third-party claims—including those against its legal representative—arising from a lack of such authorization.

8. Security and Minors' Data

GESTRAL employs security measures such as two-factor authentication and encryption to protect its systems. The processing of data belonging to minors will strictly adhere to their best interests and requires the explicit authorization of their legal guardians.

End of Document