Data Processing
1. Declaration of Regulatory Framework and Treatment
In order to guarantee the highest international standards of information protection and in compliance with the constitutional mandates in force in the jurisdiction of material operation, specifically Statutory Law 1581 of 2012 and Regulatory Decree 1377 of 2013 of the Republic of Colombia, this Comprehensive Policy governs the processing of information within the B2B infrastructure ecosystem operated under the brand W PAYMENTS.
It is imperative to establish that W PAYMENTS exclusively provides a software license for the orchestration, visibility, and routing of data instructions. The operating entity does not collect, capture, or custody fiduciary funds or financial assets directly. Consequently, the processing of information responds to an inescapable mandate of regulatory compliance, technological traceability, and security of the underlying payment networks.
2. Corporate Definitions
For the correct and exhaustive interpretation of this document, the following structural definitions are established:
B2B Client: Any natural or legal person who subscribes to the W PAYMENTS Platform services to orchestrate and manage their own payment and settlement instructions.
End User: Any natural person who interacts with the Platform's interfaces with the purpose of issuing or receiving a transaction linked to a B2B Client.
Allied Third Parties: Regulated financial institutions, clearing networks, acquirers, and liquidity providers that execute the material clearing and cross-border movement of funds.
Sensitive Data: That information which affects the privacy of the data subject, strictly including the biometric elements required for non-face-to-face identity validation.
3. The Doctrine of Divided Roles and Responsibilities
Given the technical complexity of the orchestration ecosystem, the operating entity delimits its legal liability under two autonomous spheres:
The Platform acts as the sole and exclusive Data Controller only with respect to the corporate, financial, and legal representation data of its B2B Clients, determining the purposes and technical means for its management.
Conversely, regarding the personal data, payment instruments, and transactional records of End Users, W PAYMENTS acts strictly as a Data Processor. The technological infrastructure serves as a routing conduit to Third-Party Partners, with the B2B Client bearing the non-negotiable legal obligation to act as the Data Controller and obtain the corresponding prior consents.
4. Categories of Data Collected
In the ordinary course of its technological operations, the Platform collects the following categories of information:
Corporate and Risk Information: Constitutive documents, government identifications, beneficial ownership information, proof of life through biometrics, and formal declarations of the origin of funds.
Transactional and Telemetric Information: Transaction volumes, cryptographic identifiers, network addresses, geolocation metadata, and technical fingerprints of the devices used to access the system.
5. Exhaustive and Unrenounceable Purposes of the Processing
The processing of the information managed through the Platform will be subject to technical and compliance purposes, described below:
Comprehensive Financial Compliance: Execute the know-your-customer protocols required by Third-Party Allies to mitigate identity theft, verify non-inclusion in international restrictive lists, and route the necessary validations for the prevention of money laundering and terrorist financing.
Technological Operation: Parameterize, encrypt, and channel payment instructions from their origin in the interface to the destination financial institutions.
Administrative Purposes: Perform the settlement of technology licensing fees, issue the corresponding invoicing, and manage critical system notifications.
6. International Transmission and Transfer of Data
The architecture of W PAYMENTS as a global orchestrator makes operations in a territorially restricted data network technically unfeasible. By virtue of the foregoing, by accepting this Policy, the operating entity is expressly, irrevocably, and permanently authorized to transmit and transfer databases cross-border to credit institutions in foreign jurisdictions, as well as to cloud infrastructure providers and fraud intelligence platforms, which require processing said data to execute and secure the transaction lifecycle.
7. The Processing of Sensitive Data as an Operational Imperative
The capture and validation of sensitive data, specifically facial biometrics, complies with an inescapable standard imposed by the destination financial networks and international due diligence regulations. Although providing this information is legally optional for the holder, the system's architecture does not allow transactions to be processed without compliance with these security parameters. Consequently, refusing to provide the required biometric data will technically disable access to the Platform and orchestration services.
8. B2B Client Indemnification Obligations
The B2B Client declares under penalty of perjury that they have the legal, express, and verifiable authorizations of their respective End Users to integrate their data into the W PAYMENTS infrastructure. The B2B Client assumes the unconditional obligation to defend and hold harmless the operating entity from any fine, complaint, or administrative sanction resulting from its negligence in obtaining, keeping, or managing said authorizations.
9. Rights of the Data Subjects
In strict accordance with the regulations protecting the right to Habeas Data, the data subject has the right to access, update, and rectify their personal data. Likewise, they have the right to request proof of the authorization granted, to be informed about the circulation of their data, and to request the revocation or suppression of the information, subject to the technical and regulatory limitations described in this Policy.
10. Regulatory Retention and Exception to Deletion
The guarantee of the right to erasure of personal information will be formally denied when the data subject's retention in the databases is due to an active legal or contractual obligation, such as ongoing commercial disputes or fraud investigations. Additionally, transactional and identity metadata will be retained under logical lock for a non-negotiable period of five to ten years, with the sole purpose of complying with financial crime prevention laws and remaining at the exclusive disposal of judicial requests or formal audits by Allied Third Parties.
11. Comprehensive Procedure for Inquiries and Claims
Any request related to the management of personal data must be submitted in writing to the compliance office. Requests for information will be addressed within a maximum of ten business days. Formal claims for the correction or deletion of data, properly supported, will be resolved within fifteen business days. In cases where the operating entity acts exclusively as the Data Processor, any claims received will be immediately forwarded to the corresponding B2B Client, who will assume the legal obligation to issue a substantive ruling.
12. Corporate Identification and Applicable Jurisdiction
For all technical, operational, and legal effects derived from the management of the technological infrastructure, the software ownership and the legal liability of the W PAYMENTS ecosystem rest exclusively with TWC INTERNATIONAL LLC, a limited liability company duly incorporated and existing under the laws of the State of Wyoming, United States of America. Without prejudice to the voluntary adoption of the highest local standards for the protection of user information in Colombia, the corporate parent company and the execution of this instrument are governed by the regulations of its jurisdiction of incorporation.
Official Notification Channel: legal@twcinternational.llc
13. Validity and Document Updates
This instrument is effective as of the date of its publication on the Platform's official channels. Corporate and transactional data assets will remain active for the duration of the business relationship and will extend for the periods mandated for regulatory retention. The operating entity reserves the unilateral right to modify this policy framework, providing respective notifications through the user interfaces.