Data Processing and Security Policy

In compliance with Colombian Law 1581 of 2012, Decree 1377 of 2013, and other applicable personal data protection regulations, Totalisys College discloses its data processing policy and the security measures applied to the information it manages.

1. Data controller

Totalisys College, identified by its legal representative as stated in the signed licensing contract, acts as controller and/or processor of the personal data that the Client and its users (students, guardians, teachers, administrative staff) enter into the platform.

2. Data collected

Depending on the contracted module, the platform may process the following types of data:

• Institution data: business name, tax ID, address, contact details.
• Legal representative and contact person data: name, ID, email, phone.
• Academic data: enrollment, grades, attendance, report cards, curricular information.
• Student and guardian data: name, ID, contact details, socioeconomic information where applicable to admissions or billing modules.
• HR data: résumés, employment and payroll information for institution staff, when the Client has the corresponding modules contracted.

Totalisys College does not collect or request sensitive data beyond what is strictly necessary to provide the contracted academic and administrative service.

3. Purpose of processing

Data is processed exclusively to enable the operation of the contracted software: academic, administrative, financial, and HR management of the client institution, according to the modules active on its license. Totalisys College does not use institutional data for its own commercial or advertising purposes, nor does it share it with third parties other than those strictly necessary to provide the contracted service (for example, the payment gateway used to charge for the license).

4. Data ownership

All information the Client enters into the software remains, at all times, its exclusive property. Totalisys College acts as data processor, hosting and processing that information on the Client's behalf and under its instructions, not as its owner.

5. Data subject rights (Habeas Data)

Under Colombian law, data subjects whose personal data is processed through the platform have the right to:

• Know, update, and rectify their personal data.
• Request proof of the authorization granted for processing their data.
• Be informed about how their data has been used.
• File complaints with the Superintendencia de Industria y Comercio for violations of data protection regulations.
• Revoke authorization and/or request deletion of their data, when there is no legal or contractual duty preventing its deletion.
• Access their personal data that has been processed, free of charge.

To exercise these rights, the data subject should contact the corresponding educational institution directly (the direct controller vis-à-vis the data subject), or Totalisys College via contacto@totalisyscollege.com, clearly stating the request and providing the information necessary to verify identity.

6. Security measures

Totalisys College applies reasonable technical, human, and administrative measures to protect hosted information, including:

• Password encryption using secure hashing algorithms (bcrypt) — passwords are never stored in plain text.
• Reversible encryption (AES-256) for sensitive credentials the system needs to retrieve, such as email or payment gateway configurations.
• Encrypted connections (HTTPS/TLS) between the user's browser and the platform.
• Role- and permission-based access control within the software, limiting what information each user type can view or modify.
• Each institution runs on its own subdomain and its own database, isolated from other client institutions.
• Protection against common attacks (brute force, SQL injection, request forgery) through rate limiting, data validation, and secure development practices.
• Periodic backups of information, subject to the contracted hosting infrastructure.

7. Data retention period

Data is retained while the licensing contract is active, and for the additional time required by applicable regulations (accounting, labor, academic) or reasonably necessary to address legal responsibilities. After the contractual relationship ends, the Client may request export or deletion of its information, subject to such legal retention obligations.

8. Data transfer and transmission

Data is hosted on the hosting infrastructure contracted by Totalisys College to provide the service. Totalisys College does not sell, rent, or transfer institutional data to third parties for purposes other than providing the contracted service.

9. Minors

Given the educational nature of the software, the platform processes data of minor students, entered and managed by the educational institution (the direct controller vis-à-vis the student and their family) in the exercise of its educational function and under the authorizations the institution itself has obtained from guardians in accordance with the law. Totalisys College, as data processor, applies the same security measures described in this policy to this type of information.

10. Changes to this policy

This policy may be updated when necessary. The current version will always be available on this same page.

11. Contact

For questions, requests, or complaints related to personal data processing, you can write to contacto@totalisyscollege.com.