Español · The Spanish text governs; this English version is a translation.

Data Processing Agreement (DPA)

Version: 2026-10-27

This is a translation. The Spanish text of this Agreement (engmanapp.com/es/dpa) is the one that governs. If the two texts differ, the Spanish text prevails.

This Data Processing Agreement (DPA) is part of engman's Terms of Service. It is also the personal-data transmission contract of Decreto 1377 de 2013, art. 25. It is made between:

• engman: Ruben Amauri Melo Carballo, a natural person domiciled in Colombia, who acts under the trade name engman. Address for notices: Carrera 15 # 39-20, Cartagena de Indias, Bolívar, Colombia. Email: hello@engmanapp.com.
• the Customer: the company or person that holds the Workspace, identified as the Terms state (section 1.1). In this Agreement, "you" means the Customer.

Capitalized words have the meaning the Terms give them: for example, Workspace, Owner, User, the Customer's People, Records, Proposal, Connected agent and Subprocessor (a provider that processes the Customer's personal data for engman). In addition, in this Agreement:

• Customer Data is the personal data that Users record, import or receive in the Workspace and that engman processes on your behalf.
• A data subject is the person the Customer Data is about.
• GDPR is Regulation (EU) 2016/679, the European Union's General Data Protection Regulation.

1. Subject matter and roles

This Agreement governs how engman processes Customer Data when it provides the service.

You are the Responsable (controller) of the Customer Data: you decide why and how your Users keep Records about your personnel. Where the GDPR applies, you are the controller.

engman is the Encargado (processor): it processes Customer Data only on your behalf and on your instructions (section 4). Where the GDPR applies, engman is the processor.

engman is Responsable only for its own databases, such as Users' accounts (to sign in and keep the account secure), the waitlist and the evidence of acceptance of the Terms. Those databases are governed by the Privacy Policy, not by this Agreement.

2. Form and acceptance

This Agreement is accepted online, with the same checkbox used to accept the Terms, which incorporate it by reference. Whoever creates the Workspace accepts it on your behalf and states that they have authority to bind you. Each invited User accepts it when they accept their invitation, as a user you have authorized. The Owner's acceptance binds you; another User's binds only that User.

The parties agree that this Agreement is in writing, in electronic form, as GDPR art. 28(9) requires, and that this online acceptance is how both of them sign it.

engman keeps a record of each acceptance: who accepted, in which Workspace, which version, when, from which IP address and with which browser. That record is the proof of acceptance.

If the Terms and this Agreement say different things about personal data, this Agreement prevails. For a Customer that is an exporter from the European Union, Annex 4 prevails over both.

This Agreement is published in Spanish and in English. The Spanish text is the one that governs; the English text is a translation.

3. Details of the processing (Annex 1)

Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of data, the categories of data subjects, and the scope and the activities engman carries out on your behalf. The processing lasts as long as the contract and ends with the deletion in section 12.

4. Instructions

engman processes Customer Data only on your documented instructions. Documented instructions are:

• the Terms and this Agreement;
• what Users do in the app: creating, editing, importing, confirming, sharing or deleting data, and connecting Google Calendar, Google Drive or a Connected agent; and
• additional written instructions the Owner sends to hello@engmanapp.com, if they are compatible with the service. engman keeps them with this Agreement.

These instructions include the transmissions and transfers in section 14: you instruct engman to process Customer Data from Colombia and to transmit it to the Subprocessors in Annex 3, in the countries stated there.

engman will tell you immediately if it believes an instruction infringes data protection law, and may suspend carrying it out until you confirm or change it. If a law requires engman to process Customer Data in another way, engman will tell you first, unless that same law forbids it.

engman processes Customer Data only for the purposes the data subjects authorized and in line with applicable law. It also applies your information-processing policy as far as it concerns its role as Encargado; you can send it to hello@engmanapp.com. If an instruction or that policy asks for something the service does not offer, engman will tell you and the parties will look for a solution. If they find none, you may terminate the contract by deleting the Workspace.

engman does not use Customer Data for its own purposes: it does not sell it, does not use it for advertising and does not use it to train artificial-intelligence models.

5. Confidentiality

engman keeps Customer Data confidential. Every person engman authorizes to access it commits in writing to confidentiality, or is under a legal duty of confidentiality, and accesses only what their task needs.

engman accesses the content of Customer Data only to provide the service, to handle a support request from you, to keep the service secure, or when the law requires it.

6. Security measures (Annex 2)

engman applies the technical and organizational measures in Annex 2 to protect Customer Data against unauthorized access, loss, alteration and disclosure. Annex 2 is a minimum: engman may add or strengthen measures without that changing this Agreement, but it never lowers the level of protection the annex describes.

7. Subprocessors

General authorization. By accepting this Agreement, you give engman a general written authorization to use the Subprocessors in Annex 3 and to add or replace Subprocessors under this section.

Criteria. engman chooses only Subprocessors that offer sufficient guarantees of security and data protection. It gives each one only the Customer Data its task needs, and with each one it has a contract that imposes, in substance, the same data protection obligations as this Agreement. engman remains fully liable to you for what its Subprocessors do (GDPR arts. 28(2) and 28(4); standard contractual clauses, Clause 9).

Notice of each change. Before adding or replacing a Subprocessor, engman sends an email to the Owner of each Workspace. The email states:

• the Subprocessor's name and its address or location;
• what it will do;
• the Customer Data it will process;
• its safeguards; and
• where the updated list is, with a link to the dated address of the new version of this Agreement.

The email is sent at least 30 calendar days before the Subprocessor receives any data. A replacement follows the same rule, and there is no shorter procedure for emergencies.

Silence or objection. If you do not object within those 30 days, the change is authorized. If you object, you may terminate the contract by deleting the Workspace before the date the change takes effect. In that case, engman refunds you the pro-rata share of the fees you prepaid for the period you will not use.

8. List of subprocessors (Annex 3)

Annex 3 is the current list of Subprocessors, with each one's name, address, location, activity, the data it processes and its safeguards. engman names its providers only in that list, and the Terms refer to it. Annex 3 also states which providers are not Subprocessors and why. Each version of the list stays published at the dated address of its version of this Agreement.

9. Data subject requests

You handle data subjects' requests and complaints about Customer Data. engman does not answer on your behalf.

If engman receives a request from a data subject about Customer Data, within the next 2 business days it:

• forwards it to the Owner by email; and
• tells the data subject that it forwarded the request to you (Ley 1581 de 2012, art. 15).

engman keeps proof that it received and forwarded each request. At engman, these requests are handled by the Personal Data Protection Area, at hello@engmanapp.com.

Colombian law gives you 10 business days to answer a request for information (consulta), extendable by 5, and 15 business days to answer a complaint (reclamo), extendable by 8. To help you meet those deadlines, engman assists you as follows:

• The app lets you view, correct and delete Customer Data according to each User's permissions, and export it with the features available at the time. Changes made in the app apply immediately.
• If a request cannot be handled in the app, the Owner writes to hello@engmanapp.com stating the data subject, what they ask for and what is needed from engman. engman answers in time for you to meet those deadlines, and applies the updates, corrections or deletions you instruct within the next 5 business days (art. 18).
• While a complaint is being handled, the affected Record must carry the legend "reclamo en trámite" (complaint in progress) (art. 18). Until the app has its own marker for this, the User may write the legend in the Record, or engman writes it at your request within the next 2 business days.

10. Assistance to the Responsable

Taking into account the nature of the processing and the information available to it, engman helps you meet your duties on:

• security of processing;
• notification of incidents to the authority and to data subjects;
• data protection impact assessments; and
• prior consultations with the supervisory authority.

This Agreement and its annexes already describe the processing, the security measures and the Subprocessors, and you can use them in those assessments. For anything else, the Owner writes to hello@engmanapp.com and engman answers with the information it has, within a reasonable time that lets you meet your own legal deadlines.

11. Security incidents

A security incident is a breach of security that leads to the destruction, loss, alteration, disclosure of, or unauthorized access to, Customer Data.

Notice to you. engman notifies the Owner by email of each incident that affects Customer Data, without undue delay and in any case within 72 hours of reasonably confirming it (GDPR art. 33(2)). The notice states, as far as engman knows:

• what happened;
• which categories of data it affects, and the approximate number of data subjects and Records;
• its likely consequences;
• the measures engman has taken or proposes; and
• whom to contact.

If engman does not have all the information at once, it provides it in stages, without further delay. engman also tells you, within the same period, about incidents its Subprocessors report to it that affect Customer Data.

engman's notice to the Superintendencia de Industria y Comercio. engman meets its own duty to report the incident to the Superintendencia de Industria y Comercio (Ley 1581 de 2012, art. 18(k)), within 15 business days of detecting it. engman's report to the Superintendencia does not replace your duties as Responsable, and the notice to you does not replace engman's report to the Superintendencia.

Cooperation. engman works with you to investigate, contain and remedy the incident. It does not inform data subjects on your behalf unless you ask it to or the law requires it.

12. Deletion and return

You choose. When the contract ends, you choose between deleting and getting back the Customer Data. If you do not choose, it is deleted.

Return. You can get the Customer Data back with the export features available in the app at the time, before deleting the Workspace. engman does not make manual exports.

Deletion when the Workspace is deleted. The Owner can delete the Workspace at any time in the app, after verifying their second factor again and typing the Workspace's name. Then:

• engman immediately deletes the Customer Data from the live database, together with the accounts of the Workspace's Users;
• the backups that still contain it expire within 7 days at most; and
• engman confirms the deletion to the Owner by email, with the date the last backup expires.

After a backup expires, Google, as a Subprocessor, purges it from its systems within 180 days at most; during that time neither engman nor you can recover or restore it.

engman keeps only the records of acceptance of the Terms, which are engman's own data, evidence of the contract, governed by the Privacy Policy.

Termination for another reason. If the contract ends in another way (for example, because engman terminates it under the Terms), you can export the Customer Data until the termination date or, if engman terminated it immediately, during the following 30 days, unless doing so creates a risk to the security of the service or is unlawful. After that, engman deletes it within 30 calendar days, with the same backup and confirmation rules.

Scheduled deletions during the contract. While the contract is in force, engman automatically deletes:

• what a manager who left the company still holds in their name (their private Records, their private notes and the upward feedback they wrote down), 30 days after they were archived;
• an archived person, with their Records and history, 24 months after they left the company, and never before their archiving is final; the Owner can delete them sooner;
• imported original files, as soon as their import is settled and at most 30 days after upload; and
• Proposals nobody confirmed or discarded within 30 days.

An archived person can be restored within 30 days of being archived; after that, the archiving is final.

Retention required by law. engman does not keep Customer Data after deleting it unless a law requires it to. In that case it tells you and keeps protecting the data under this Agreement.

13. Audits and information

Information. engman makes available to you the information needed to show that it complies with this Agreement: this Agreement and its annexes, written answers to reasonable security and data protection questionnaires, and the compliance information each Subprocessor publishes or allows engman to share. You request it at hello@engmanapp.com, at any time, and engman answers within a reasonable time.

Audit. If that information is not enough, you may audit compliance with this Agreement, yourself or with an auditor you choose, once every 12 months. You may also do so after an incident that affects Customer Data or when a supervisory authority requires it. The rules are:

• you give at least 30 calendar days' notice, unless an authority sets a shorter period;
• the audit is done remotely first (documents and interviews), and on site only if that is not enough;
• the auditor commits in writing to confidentiality, and engman may object to the auditor only if it is a competitor of engman;
• the audit gives no access to other customers' data or to information that would put the security of the service at risk; and
• Subprocessors' infrastructure is audited through the reports and certifications they offer.

Costs. Each party bears its own costs. If an audit requires work from engman beyond what is reasonable, engman may charge reasonable, documented costs, agreed with you in advance and never disproportionate.

14. International transfers

Where the data is processed. engman operates from Colombia. Customer Data is hosted on Google Cloud in the United States, and the Subprocessors in Annex 3 process it in the countries stated there.

Customers in Colombia. Sending Customer Data to engman and to its Subprocessors in the United States is a transmission of data from a Responsable to an Encargado. This Agreement is the transmission contract of Decreto 1377 de 2013, art. 25. The United States is on the Superintendencia de Industria y Comercio's list of countries with an adequate level of protection.

Other customers outside the European Union. This same Agreement applies.

Customers exporting from the European Union. Colombia has no European Commission adequacy decision. So, if you are subject to the GDPR and transfer Customer Data to engman, Annex 4 also applies; it incorporates the European Commission's standard contractual clauses (Module 2). Annex 4 is governed by the law of a European Union Member State (Clauses 17 and 18), as an exception to Colombian law. It also provides for the Clause 14 assessment and for onward transfers to Subprocessors under Clauses 8.8 and 9(b).

15. Sensitive data and minors

Special-category data. In this Agreement, "special-category data" means the sensitive data (datos sensibles) of Colombian law and the special categories of data of the GDPR: the health of anyone, religion, politics, sex life, union membership, ethnic origin and biometric data, among others.

• You warrant that, if your Users record special-category data, they do so only when it is necessary and lawful, with the data subject's explicit authorization or another basis the law allows, and without making any activity conditional on the data subject providing it. Avoid health data unless it is essential.
• engman cannot tell special-category data apart within a Record's free text. It processes it only on your instructions and with the measures in Annex 2, with no separate handling beyond the encrypted fields that annex lists.
• No engman feature depends on special-category data. engman's artificial intelligence does not propose it: it keeps the work-relevant fact, without the reason.

Minors. engman is not designed for keeping Records about children or adolescents. If you keep any, you do so under your own responsibility and in compliance with the special rules of Colombian law.

16. Changes to the DPA

Every change to this Agreement, including its annexes, is a material change of the Terms version, even if it only changes the wording or the English translation. The only exception is adding or replacing a Subprocessor, which follows section 7.

For a material change to this Agreement:

• engman sends an email to the Owner of each Workspace, at least 30 calendar days before the effective date, saying what changes. engman keeps those emails as evidence.
• The new version is published at its dated address, and earlier versions stay published at theirs.
• From the effective date, each User must accept the new version in the web app to keep using it, and their Connected agents cannot work until they accept.
• The Owner's acceptance is your approval of the change, as Responsable. Publishing the change on the website is not enough (European Data Protection Board, Guidelines 07/2020, para. 110).
• Until the Owner accepts, the previous version keeps governing the processing of Customer Data.
• If you do not accept the change, you may terminate the contract by deleting the Workspace, with the pro-rata refund in section 7.

17. Governing law and disputes

This Agreement is governed by the same law as the Terms, and disputes about it are resolved as the Terms say. The exception is Annex 4: for a Customer that is an exporter from the European Union, the standard contractual clauses are governed by the law of a European Union Member State, and disputes about them go to the courts stated there (Clauses 17 and 18).

18. Notice template for the Customer's personnel (Annex 5, es/en)

You must inform each person your Users keep Records about: that you use engman, for what, what rights they have and how to exercise them. Annex 5 provides a ready notice, in Spanish and in English, with blanks for you to fill in.

Give it to each person within one month of recording their first data in engman and, in any case, before recording their first 1:1. Using the template does not change that the notice is your responsibility.

Annex 1. Details of the processing

Parties and contacts

• Responsable (and exporter, for Annex 4): the Customer, with the legal name (or, for a natural person, their name), the country and, if one was recorded, the tax identification number recorded when the Workspace was created. Contact: the Owner, at their account email.
• Encargado (and importer, for Annex 4): engman, Ruben Amauri Melo Carballo, Carrera 15 # 39-20, Cartagena de Indias, Bolívar, Colombia. Email: hello@engmanapp.com. Phone: +57 318 659 4497. Data subject requests: Personal Data Protection Area.

Subject matter. Providing the engman service: a space where the Customer's tech leaders keep 1:1s, feedback and career plans for the people they manage, and import the records they already keep elsewhere.

Duration. As long as the contract, until the deletion in section 12.

Purpose. Letting the Customer's Users prepare, hold and follow up on their personnel's 1:1s, feedback and career plans, and organize their teams, for the purposes the Customer sets as Responsable. engman processes Customer Data for no purpose of its own.

Nature and activities. engman carries out these activities on the Customer's behalf:

• hosting and storing Customer Data and its backups;
• showing it to each User according to the visibility rules: the chain of command, private Records, and the content of a 1:1, which only the manager who holds it sees;
• searching and sorting Records for the User;
• importing the documents a User uploads or picks in Google Drive, and extracting Proposals from them with artificial intelligence;
• preparing agendas with artificial intelligence;
• sending the service's emails: invitations, account notices and, when a User sends them, 1:1 agendas and the periodic digest email;
• if a User connects Google Calendar, reading the events on their own calendars to find their 1:1s, and writing the agenda into the description of the events they organize;
• giving the Connected agents a User authorizes only the data this Agreement allows (today, only identifiers: names, work emails, teams, who each person reports to, dates, statuses, counts (for example, of open or overdue action items), email language and internal ids, never what Records say), and saving what those agents write as Proposals;
• recording audit events (who did what and when, with identifiers); and
• deleting data under section 12.

On artificial intelligence:

• engman's artificial intelligence extracts, groups and summarizes the Customer's own Records, with links to their sources, and drafts agendas.
• engman's artificial intelligence never rates, ranks, scores or compares people, never infers emotion, and never recommends hiring, promoting, disciplining or dismissing anyone.
• Every artificial-intelligence output and every write by a Connected agent is a Proposal that a person reviews and confirms in the web app before it is saved.

Scope. Only the Customer Data of its Workspace; only to provide the service; only from Colombia (engman) and in the countries in Annex 3; and only with the Subprocessors in Annex 3.

Categories of data subjects

• The Customer's People: its employees and, where the Customer has determined it is lawful, contractors or vendor engineers.
• Users, as part of the Customer's personnel: their place in the org chart and the Records other Users keep about them.
• Other people a User mentions in a Record's free text, under the Customer's responsibility.

Types of data

• Identification and organization: name, work email, team, direct manager and chain of command, discipline, level and track, roles (for example, manager or tech lead), email language, leaving date and change history.
• 1:1s: agenda, notes and action items, including skip-level 1:1s.
• Feedback a manager gave a person, memos and career plans (objectives, levels and resources).
• Private notes and upward feedback (what a person says about their manager), encrypted as Annex 2 describes.
• Imported documents: the original file until the import is settled (30 days at most), the extracted text and the Proposals. After that, only the file's name, size and SHA-256 fingerprint remain.
• Proposals from artificial intelligence and from Connected agents.
• Calendar data, if a User connects Google Calendar: the events on their own calendars (for example, date, time, title and attendees).
• Audit events.
• Special-category data: the service does not need it; it exists only if the Customer records it, under section 15.

Frequency. Continuous, while the contract is in force.

Retention. Under section 12. Audit events: as long as the Workspace exists; they are deleted when it is deleted.

Transmissions to Subprocessors. Those in Annex 3, for the activities stated there, for the duration of the contract.

engman's obligations. engman's obligations to you and to data subjects are those in sections 4 to 16 of this Agreement. Among them: processing the data on your behalf in line with the principles that protect it, safeguarding the security of the databases, and keeping the processing confidential.

Annex 2. Security measures

These are the minimum measures engman applies to Customer Data (section 6).

Encryption

• Encryption in transit between the browser, the app and the Subprocessors, and encryption at rest of the database, files and backups.
• In addition, the text of private notes and of upward feedback is encrypted field by field with AES-256-GCM, with one data key per Workspace, itself protected by a Google Cloud KMS key that rotates automatically. An encrypted value never appears in a Record's title or search text.
• Users' Google access and refresh tokens and their recovery codes are stored encrypted.

Isolation between customers

• Every row of data carries its Workspace's identifier, and the database's row-level security prevents reading or writing another Workspace's data. The app uses a database role that cannot bypass that rule.
• Each exception to that rule is a small, named function that gets a security review. Automated tests fail if a table is left without that protection.

Access control within the Workspace

• Each User sees only what the visibility rules allow: their chain of command, each manager's private Records, and the content of a 1:1, which only the manager who holds it sees.
• Sensitive actions (changing factors, deleting an archived person, exporting, approving a Connected agent, deleting the Workspace) require verifying the second factor again.

Authentication

• Every User signs in with a second factor (a passkey or a code from an authenticator app), Google sign-in included.
• Passwords are checked against lists of breached passwords and stored with Argon2id.
• Sessions are stored in the database and expire after inactivity and after an absolute limit.

Connected agents

• An agent connects only after its User verifies their second factor and approves the connection.
• Today agents see only identifiers; everything they write is a Proposal a person confirms in the web app.
• The Owner can turn agents off for the Workspace, and the Owner or the User can revoke each connection. Agent calls are rate-limited.

Activity records and monitoring

• Every action on Customer Data goes through a single point that checks permissions and writes an audit event.
• Technical logs, errors, metrics and alerts carry identifiers only, never names, emails, Record content or tokens, and each source has a test that checks this. They stay in Google Cloud; no other provider receives them.

Backups and continuity

• Daily backups that expire after 7 days, point-in-time recovery, and deletion protection on the database.
• A written restore procedure, which engman tests before receiving its first customer's data and after every change to backups.

Minimization

• Imported original files are deleted as soon as the import is settled, and at most 30 days after upload.
• A settled Proposal keeps only its control data (kind, status, source, who settled it, the Connected agent that made it, the resulting Record and its dates); its content is erased. Unsettled Proposals are discarded after 30 days.

Infrastructure and development

• The database accepts no direct connections from the internet; only the app reaches it. The service's keys and passwords are stored in Google Secret Manager.
• Every software change reaches production through a pull request, with automated tests and security scans of dependencies, secrets and the container image.

Organization

• Confidentiality of every person with access (section 5), access only to what each task needs, and written procedures for incidents, restores and deployments.

Annex 3. List of subprocessors

List in force in version 2026-10-27.

Not Subprocessors:

• Paddle, once engman charges through Paddle: it is an independent controller of payment data and receives no Customer Data.
• Connected agents. What a User sends to an agent they connect leaves engman and falls under the terms of that agent's provider.
• The User's Google Calendar and Google Drive. When a User connects them, engman reads from and writes to the User's own Google account, on their instruction. What stays in that account is governed by your or the User's contract with Google.

Annex 4. EU standard contractual clauses (Module 2)

When it applies. This annex applies when you, as a controller subject to the GDPR, transfer Customer Data to engman, which processes it from Colombia, a country without a European Commission adequacy decision.

Incorporation. The standard contractual clauses of Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (OJ L 199, 7.6.2021), Module Two (controller to processor), form part of this Agreement by reference, with the options in this annex. Their text is the one published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. You are the data exporter; engman is the data importer.

Options chosen

• Clause 7 (docking clause): included. Another entity may accede to the clauses with the parties' agreement, for example an affiliate of yours as an exporter: it writes to hello@engmanapp.com with its details for Annex I.A, and the accession is complete when engman accepts it in writing.
• Clause 9(a): Option 2, general written authorization. engman gives notice of each addition or replacement of a Subprocessor at least 30 days in advance, under section 7 of this Agreement.
• Clause 11(a): the option of an independent dispute resolution body is not included.
• Clause 13 (supervision): the competent supervisory authority is:
  • if you are established in an EU Member State, the authority responsible for supervising your compliance with the GDPR as exporter;
  • if you are not established in the EU, are subject to the GDPR under its art. 3(2) and have appointed a representative, the authority of the Member State where your representative is established;
  • if you are not established in the EU, are subject to the GDPR under its art. 3(2) and are not required to appoint a representative, the authority of one of the Member States where the data subjects are located, which you tell engman in writing.
• Clause 17 (governing law): Option 2. The law of the EU Member State where you are established governs. If that law does not allow for third-party beneficiary rights, the law of Spain governs.
• Clause 18(b) (courts): the courts of the Member State whose law governs under Clause 17.

Mapping of the appendix

Clause 14 assessment. engman gives you the information it reasonably has about the laws and practices of Colombia and of the Subprocessors' countries that is relevant to your assessment, and notifies you under that clause if it can no longer comply with it.

Onward transfers. engman transfers Customer Data only to the Subprocessors in Annex 3, with a contract that imposes on them, in substance, the same obligations (Clause 9(b)), and only when one of the conditions of Clause 8.8 is met.

Precedence. If this Agreement or the Terms contradict the standard contractual clauses, the clauses prevail. The sections of this Agreement on instructions, audits, deletion and incidents are how engman complies with the clauses, insofar as they do not contradict them. The confirmation of deletion in section 12 counts as the certification the clauses require.

Annex 5. Notice template for the Customer's personnel

How to use it. Copy the notice in each person's language and fill in every blank between angle quotes («…»). Remove the parts marked Solo si aplica / Only if it applies that do not apply, and adjust the purposes to your case. Give it to each person within one month of recording their first data in engman and, in any case, before recording their first 1:1; to people who already work with you, when you start using engman. Keep proof of delivery and, if the basis is authorization, obtain it by a means that lets you prove it.

Versión en español

Aviso sobre el uso de engman

Quién es el responsable. «Razón social de la empresa» (la empresa o el Cliente), identificada con «NIT o número de registro», con domicilio en «dirección», es la responsable del tratamiento de los datos personales que describe este aviso. Contacto para temas de datos personales: «correo», «teléfono», «dirección». Delegado de protección de datos: «nombre y contacto, o "no aplica"».

Qué es engman. Sus managers usan engman, una aplicación donde los líderes de tecnología llevan los 1:1, el feedback y los planes de carrera de las personas que dirigen. engman (Ruben Amauri Melo Carballo, que actúa bajo el nombre comercial engman) trata sus datos solo por cuenta de la empresa, como encargado. En este aviso, los Registros son los 1:1, las acciones, el feedback, los planes de carrera, los documentos importados y las notas que sus managers llevan en engman; una Propuesta es un borrador que espera confirmación; y un Agente conectado es un asistente de inteligencia artificial que un manager conecta a engman.

Para qué usamos sus datos. Preparar y llevar sus 1:1 y dar seguimiento a lo acordado; registrar el feedback que su manager le da; acordar y dar seguimiento a su plan de carrera; organizar los equipos y la cadena de mando; «otras finalidades, o quite las que no apliquen».

Con qué base. En Colombia: «la autorización que usted nos da por (medio), u otra base que la ley permita (cuál)». Solo si aplica: para personas en la Unión Europea, la base jurídica del RGPD es «por ejemplo, el interés legítimo de la empresa en (cuál), o la ejecución del contrato de trabajo».

Qué datos. Su nombre, correo de trabajo, equipo, manager, nivel y trayectoria; lo que se habla en sus 1:1 (agenda, notas y acciones); el feedback que recibe; su plan de carrera; los documentos sobre usted que la empresa importa; «otros datos».

Datos sensibles. Su manager no necesita datos sensibles, como los de salud, afiliación sindical, religión, política, vida sexual, origen étnico o biométricos. Si una conversación los toca, usted no está obligado a autorizar su tratamiento, y responder preguntas sobre ellos es facultativo.

De dónde vienen. De lo que usted cuenta en sus 1:1, de lo que su manager observa y anota, y de «otras fuentes, por ejemplo, sistemas de recursos humanos o documentos que la empresa importa».

Quién los ve. Lo que dice un 1:1 solo lo ve el manager que lo tiene. Los demás Registros los ve su manager y, salvo los privados, la cadena de mando por encima de él. «Otras áreas o personas de la empresa que reciben estos datos, si las hay».

Quién más los trata. engman, como encargado, y sus subencargados (hoy, Google Cloud para el alojamiento y la inteligencia artificial, y Postmark para los correos), según la lista vigente en https://engmanapp.com/es/dpa. Si un manager conecta un Agente conectado, ese proveedor recibe hoy solo identificadores (nombres, correos de trabajo, equipos, a quién reporta cada persona, fechas, estados, conteos (por ejemplo, de acciones abiertas o vencidas), idioma de los correos e identificadores internos), bajo sus propios términos.

Transferencias internacionales. Sus datos se alojan en los Estados Unidos (Google Cloud) y engman los trata desde Colombia. Solo si aplica: para personas en la Unión Europea, Colombia no tiene una decisión de adecuación de la Comisión Europea, y la transferencia se ampara en las cláusulas contractuales tipo de la Comisión Europea; puede pedir una copia en «contacto».

Inteligencia artificial. La inteligencia artificial de engman extrae, agrupa y resume los Registros del propio Cliente, con enlaces a sus fuentes, y redacta agendas. La inteligencia artificial de engman nunca califica, clasifica, puntúa ni compara a las personas, no infiere emociones y no recomienda contratar, promover, sancionar ni despedir a nadie. Todo resultado de la inteligencia artificial y toda escritura de un Agente conectado es una Propuesta que una persona revisa y confirma en la aplicación web antes de que se guarde. La empresa no toma decisiones automatizadas sobre usted con engman, y no usa los resultados de la inteligencia artificial de engman como base para evaluar su desempeño ni para decisiones de contratación, promoción, salario, sanción o despido.

Cuánto tiempo. «Plazo o criterio de la empresa». Cuando la empresa registra en engman que una persona salió, engman suprime sus datos 24 meses después de su salida, o antes si la empresa lo pide.

Sus derechos. Usted puede conocer, actualizar y rectificar sus datos; pedir prueba de la autorización; saber cómo se usan sus datos; revocar la autorización o pedir la supresión cuando no se respeten sus derechos; acceder gratis a sus datos; y presentar quejas ante la Superintendencia de Industria y Comercio después de consultar o reclamar a la empresa. Solo si aplica: si usted está en la Unión Europea, también puede pedir el acceso, la rectificación, la supresión, la limitación y la portabilidad de sus datos, retirar su consentimiento si esa es la base, y reclamar ante «autoridad de control».

Solo si aplica, para personas en la Unión Europea: Derecho de oposición. Usted puede oponerse en cualquier momento, por motivos relacionados con su situación particular, al tratamiento de sus datos basado en el interés legítimo de la empresa.

Cómo ejercerlos. Escriba a «correo». La empresa responde las consultas en un máximo de 10 días hábiles (prorrogables por 5) y los reclamos en un máximo de 15 días hábiles (prorrogables por 8). Si usted le escribe a engman (hello@engmanapp.com), engman reenvía su solicitud a la empresa dentro de 2 días hábiles y le avisa a usted.

Fecha de este aviso: «fecha».

English version

Notice about the use of engman

Who the controller is. «Company legal name» (the company or the Customer), identified by «tax ID or registration number», with its registered address at «address», is the controller of the personal data this notice describes. Contact for personal data matters: «email», «phone», «address». Data protection officer: «name and contact, or "not applicable"».

What engman is. Your managers use engman, an application where tech leaders keep 1:1s, feedback and career plans for the people they manage. engman (Ruben Amauri Melo Carballo, acting under the trade name engman) processes your data only on behalf of the company, as a processor. In this notice, Records are the 1:1s, action items, feedback, career plans, imported documents and notes your managers keep in engman; a Proposal is a draft waiting for confirmation; and a Connected agent is an artificial-intelligence assistant a manager connects to engman.

What we use your data for. Preparing and holding your 1:1s and following up on what was agreed; recording the feedback your manager gives you; agreeing and following your career plan; organizing teams and the chain of command; «other purposes, or remove those that do not apply».

On what basis. In Colombia: «the authorization you give us through (means), or another basis the law allows (which)». Only if it applies: for people in the European Union, the GDPR legal basis is «for example, the company's legitimate interest in (what), or the performance of the employment contract».

What data. Your name, work email, team, manager, level and track; what is discussed in your 1:1s (agenda, notes and action items); the feedback you receive; your career plan; the documents about you that the company imports; «other data».

Sensitive data. Your manager does not need sensitive data, such as data about health, union membership, religion, politics, sex life, ethnic origin or biometrics. If a conversation touches on it, you are not obliged to authorize its processing, and answering questions about it is optional.

Where it comes from. From what you say in your 1:1s, from what your manager observes and writes down, and from «other sources, for example HR systems or documents the company imports».

Who sees it. What a 1:1 says is seen only by the manager who holds it. Your manager sees your other Records and, except private ones, so does the chain of command above them. «Other areas or people in the company who receive this data, if any».

Who else processes it. engman, as a processor, and its subprocessors (today, Google Cloud for hosting and artificial intelligence, and Postmark for email), as listed at https://engmanapp.com/dpa. If a manager connects a Connected agent, that provider today receives only identifiers (names, work emails, teams, who each person reports to, dates, statuses, counts (for example, of open or overdue action items), email language and internal ids), under its own terms.

International transfers. Your data is hosted in the United States (Google Cloud) and engman processes it from Colombia. Only if it applies: for people in the European Union, Colombia has no European Commission adequacy decision, and the transfer relies on the European Commission's standard contractual clauses; you can ask for a copy at «contact».

Artificial intelligence. engman's artificial intelligence extracts, groups and summarizes the Customer's own Records, with links to their sources, and drafts agendas. engman's artificial intelligence never rates, ranks, scores or compares people, never infers emotion, and never recommends hiring, promoting, disciplining or dismissing anyone. Every artificial-intelligence output and every write by a Connected agent is a Proposal that a person reviews and confirms in the web app before it is saved. The company makes no automated decisions about you with engman, and does not use engman's artificial-intelligence output as a basis for evaluating your performance or for hiring, promotion, pay, discipline or dismissal decisions.

How long. «The company's period or criteria». When the company records in engman that a person has left, engman deletes their data 24 months after they left, or sooner if the company asks.

Your rights. You can know, update and correct your data; ask for proof of the authorization; find out how your data is used; revoke the authorization or ask for deletion when your rights are not respected; access your data free of charge; and complain to the Superintendencia de Industria y Comercio after first asking or complaining to the company. Only if it applies: if you are in the European Union, you can also ask for access to, correction, erasure, restriction and portability of your data, withdraw your consent if that is the basis, and complain to «supervisory authority».

Only if it applies, for people in the European Union: Right to object. You can object at any time, on grounds relating to your particular situation, to processing of your data based on the company's legitimate interest.

How to exercise them. Write to «email». The company answers requests for information within 10 business days at most (extendable by 5) and complaints within 15 business days at most (extendable by 8). If you write to engman (hello@engmanapp.com), engman forwards your request to the company within 2 business days and tells you it did.

Date of this notice: «date».