Skip to the document

Data processing terms

Know the responsibilities for client data.

Version data-processing-2026-11-10-9eda2e248009. Effective 2026-11-10.

Parties and roles

KAURO DATA S.A.S. (a sociedad por acciones simplificada incorporated in Colombia, tax ID NIT 902120412-8) operates Kauro. Its registered address is Calle 109 # 15 BIS - 04 Apartamento 201, Bucaramanga, Santander, Colombia. Its postal contact is KAURO DATA S.A.S., Calle 109 # 15 BIS - 04 Apartamento 201, Bucaramanga, Santander, Colombia. Its legal contact is contact@kaurodata.com. Its phone number is +57 314 402 2549.

These terms take effect on 2026-11-10. In them Kauro is the processor, or the sub-processor where the chain below says so.

Under Colombian law these terms are the data transmission contract between the controller and Kauro as processor. Kauro processes the data on the controller's behalf, in line with the principles of Colombian data protection law, with the controller's instructions and with the purposes for which the controller may lawfully process it. It safeguards the security of the data and keeps it confidential.

The roles follow the processing that is actually done, and the order or the project record names the controller and the chain of authority for each project. Kauro does not assume that every agency owns all the data it uploads.

Instructions

Kauro processes personal data only on the customer's documented instructions. They are these terms, the order and the decisions that the customer's authorized users record in the application.

The processing covers file receipt, inspection, profiling, bounded semantic proposal, deterministic transformation, validation, delivery, support and deletion.

The business purpose of the processing is to receive the CRM files the customer uploads, inspect and profile them, propose and apply the changes the customer approves, such as cleaning, deduplication and mapping to the target, validate the result, deliver the import package, give support for the project and delete the data when its retention window ends. The customer discloses the data to Kauro only for that purpose, and Kauro processes it only for the free data health checks the customer asks for and the orders it places.

An instruction to keep data indefinitely, to process a category of sensitive data the service does not support, or to send raw records to a model provider that is not approved is rejected or sent for separate review.

Data and people concerned

The service takes ordinary business CRM data within the free check or the order: contact, company and deal records and the other fields the uploaded files contain, including record identifiers and the messages in import result files that the customer supplies. The stored profile of a file holds its column names and counts, and is shown to the customer's authorized users. After the files are deleted, the project's record keeps its column names, its decisions and its destination details, and a repeat project the customer starts can reuse them. A column name is whatever the file's first row holds, so a file exported without a header row leaves that row's values in the project's record: upload files with a header row. The people concerned are those the records describe, such as the controller's customers, prospects, contacts and staff.

Credentials and authentication secrets, full payment card data, sensitive data as Colombian law defines it (such as health or biometric data, political or religious views, sex life and union membership) and its equivalents under other laws, data of children and adolescents, and any other category whose obligations or security needs go beyond the qualified service are not accepted.

What Kauro does not do with the data

Kauro does not sell or share customer data. It does not retain, use or disclose it for any purpose, commercial or otherwise, other than the business purpose described above, or outside its direct business relationship with the customer. It does not combine or update it with personal information that Kauro receives from any source other than the customer, such as other customers or Kauro's own contacts, does not use it to train or improve language models, and does not use it to contact, profile or sell to the people it describes.

Confidentiality and security

Kauro requires the people who can reach the data to keep it confidential. It keeps each customer's files and results apart from every other customer's, limits access to what the work needs, and applies security measures suited to the risk. It may change a measure only without lowering the protection.

Besides Kauro's owner, a freelance support provider may read the written support messages a customer sends, to answer questions about using the service. It is an independent contractor bound to Kauro by written confidentiality and data processing terms, acts only on Kauro's instructions, and gets no access to a customer's projects, files or CRM data. A customer must not put CRM records in a support message; if one arrives, the provider passes it to Kauro, which deletes it under its procedure.

Each party applies technical and organizational measures suited to the risk for its own part: Kauro for the service and the data it holds, and the customer for its accounts, the access it gives its users and the files once downloaded.

Rights requests and incidents

Kauro helps the controller answer a rights request to the extent of what the service holds, and does not answer it on the controller's behalf without instruction.

Kauro sends the controller, within two business days, any request that only the controller can decide, and carries out the controller's decision within the periods the law sets. When the controller reports that information must be updated, corrected or deleted, Kauro acts on it within five business days of receipt: it deletes the affected files and results, or works only from the corrected files the controller uploads. Kauro does not edit records inside a file the customer sealed.

Kauro tells the customer without undue delay once it becomes aware of an incident that affects the customer's data, and in any case within seventy-two hours. It states the facts it knows and when the next update will come, and does not wait for a full root cause. Where Colombian law requires it, Kauro also reports the incident to the Colombian data protection authority, in coordination with the customer.

Subprocessors

Kauro uses the providers below, and each entry says what it receives. A provider that receives customer data is a subprocessor of that data: Kauro binds it by a written contract that requires it to meet, for the data it receives, the data protection obligations that Kauro has under these terms and the applicable law, and stays responsible for how it handles the data.

Changing a subprocessor

Kauro reviews the data flow and the contract before it adds or replaces a subprocessor, and has a plan for exit and deletion.

Kauro tells the customer's administrators by e-mail at least thirty days before it adds or replaces a provider that receives customer data, naming the provider, what it does, what data it receives and where. The customer can object on reasonable data protection grounds within that period. If the objection cannot be resolved, the customer can end the affected orders that have not started and receive back what it paid for them.

International transfers

Sending customer data to Kauro, and from Kauro to its subprocessors, is a transmission to a processor for processing on the controller's behalf, not a transfer to a new controller. The location and transfer basis of each subprocessor are listed above. Whether a transfer is lawful depends on the roles, the data and the places involved: hosting in a given country is neither automatically sufficient nor automatically forbidden.

United States state privacy laws

For a customer subject to the privacy laws of California, Virginia or Colorado, Kauro acts as that customer's service provider or processor, and these terms bind both parties. Kauro processes the data only for the business purpose described above and follows the customer's instructions. It complies with the obligations those laws and their regulations place on it, and gives the data the same level of privacy protection they require of the customer.

As far as the service allows, Kauro helps the customer answer the requests of the people the data describes, secure the data and give the breach notices those laws require, and carry out its data protection and risk assessments. If the customer tells Kauro of such a request, Kauro does what the request needs for the data it holds.

Kauro tells the customer if it can no longer meet those obligations. The customer can take reasonable and appropriate steps to make sure that Kauro uses the data as those laws require, including reviews, assessments, testing and inspections at least once every twelve months, and, on notice, to stop and remedy any use it has not authorized.

Kauro engages a subprocessor only after telling the customer and giving it the chance to object, as described above, and only under a written contract that imposes these same obligations. At the end of the service, or earlier at the customer's direction, Kauro deletes the data or lets the customer take it back first, as the customer chooses, unless the law requires Kauro to keep it.

A project subject to another privacy law is accepted only once Kauro has agreed the terms that law requires.

Return and deletion

When the retention windows of the service terms end, or earlier when the customer asks, Kauro deletes the customer's files, results and packages and can confirm that it did. The project's record (its column names and counts, its decisions and its destination details) stays after that, while the account is active and up to six months after it closes. Kauro deletes it sooner when the customer asks in writing, and a repeat project can then no longer reuse it. Records that the law requires are kept apart from CRM contents.

Before deletion the customer can download what the service still holds. Kauro's deletion receipt covers what Kauro controls; it does not cover copies the customer already downloaded or imports the customer made.

Deleted data is removed from the storage of Kauro's hosting provider within seven days after the deletion, except while a hold that an incident investigation or the law requires keeps it.

Evidence of compliance

On request Kauro provides the evidence needed to show that it meets these terms, such as its records of what it processed and when it deleted it, within the limits of confidentiality and of other customers' data.

Kauro also allows, and contributes to, reasonable reviews and inspections by the customer, or by an independent inspector the customer appoints, on reasonable notice, limited to what is needed and under confidentiality. Each party bears its own costs.

Governing law and forum

These terms are governed by the laws of the Republic of Colombia. The forum for disputes is the competent judges of the Republic of Colombia under the statutory rules of jurisdiction and competence.

Changes and versions

A change to these terms is published as a new version with its own effective date. The version label at the top of this page names the document, its effective date and a digest of its exact text, so a label always identifies the same words. An order keeps the version its customer accepted; a later edit to this page does not amend it.

Contact

Write to contact@kaurodata.com, or by post to KAURO DATA S.A.S., Calle 109 # 15 BIS - 04 Apartamento 201, Bucaramanga, Santander, Colombia.